CISA has added the critical vulnerability CVE-2023-49105 (CVSS 9.8) in the ownCloud platform to the Known Exploited Vulnerabilities (KEV) catalog after Hunt.io researchers uncovered a targeted cyber-espionage operation: a Chinese-speaking operator used this vulnerability to steal data from a Philippine nuclear research center, including nuclear material accounting records, strategic plans, and information on research reactor components. Organizations running ownCloud core versions 10.6.0 through 10.13.0 must immediately upgrade to version 10.13.1 or later.
Technical essence of vulnerability CVE-2023-49105
CVE-2023-49105 is an authentication bypass vulnerability in the ownCloud WebDAV API related to the mechanism for pre-signed URLs. According to the entry in the GitHub Advisory Database, under the default configuration—when a user has no signing key set—an attacker who knows the username can craft signed WebDAV requests that the server accepts as legitimate authentication. This opens full access to files: reading, modification, and deletion—without providing any credentials.
The vulnerability affects ownCloud core versions from 10.6.0 through 10.13.0 inclusive. A fix was released in version 10.13.1. Although the vulnerability was disclosed by ownCloud back in November 2023, almost three years later it is still being exploited in real-world attacks—which indicates a significant number of unpatched instances.
Anatomy of the operation: how the nuclear center’s data was stolen
According to Hunt.io, on August 13, 2026, researchers discovered an open directory on the server at 31.58.209[.]241 containing custom Python scripts, open source offensive tools (Sliver, Metasploit, Mettle), and exfiltrated data from two Philippine organizations.
The five discovered Python scripts implemented an exploit for CVE-2023-49105, generating pre-signed WebDAV requests with an empty signing secret. Four scripts were targeted at specific accounts, while the fifth performed WebDAV directory enumeration and logged every download attempt.
Hunt.io estimates that the operator downloaded 176 files totaling about 372 MB from the nuclear research center’s ownCloud instance, spreading them across five staging directories. Among the stolen materials, the following were reportedly present:
- Nuclear material accounting records
- Draft strategic plans for 2023–2028
- Information on research reactor core components and historical fuel inventory data
- Employee personal data
- A 192 MB SQL dump of the ZKTeco BioTime database (a time and attendance and personnel system)
- Credential stores: BitLocker keys, a KeePass database, and AxCrypt-encrypted files
Important caveat: in the attacker’s data, researchers found a CSV file referencing roughly 9 GB of exfiltrated data from ownCloud; however, this volume is not corroborated by the contents of the discovered staging directories and may reflect earlier or additional collection operations.
Second target: a marine engineering company
In parallel, the same operator, according to Hunt.io, compromised the WordPress site of a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy. Two independent attack vectors were used:
- CVE-2024-28000 (CVSS 9.8) — an unauthenticated privilege escalation vulnerability in the LiteSpeed Cache plugin for WordPress (versions 1.9 through 6.3.0.1 are affected, fixed in 6.4). The exploit allowed the creation of a new administrator account via the REST API.
- The
brute_xmlrpc.pyscript — a credential brute-force attack via the WordPress XML-RPC interface using the rockyou.txt wordlist. A matching credential pair was found in the logs.
In addition, on the same WordPress site, researchers found what appears to be a separate compromise, likely unrelated to the main operator, using the EtherHiding technique: malicious code retrieved HTML content from an Ethereum smart contract and displayed a fake Google verification page in ClickFix style, triggering a pcalua.exe → mshta.exe → VBScript dropper chain.
Attribution and geopolitical context
Hunt.io assesses the operator as Chinese-speaking based on the presence of Simplified Chinese in source code comments, documentation strings, execution logs, and directory names used to sort exfiltrated data. It should be emphasized: linguistic artifacts support only a linguistic assessment and do not allow attribution of the activity to a specific state entity or known APT group.
Nevertheless, the choice of targets—a nuclear research center and a contractor of the Philippine Navy—aligns with interests associated with current tensions in the South China Sea. The nature of the stolen materials (nuclear accounting records, strategic plans, reactor data) points to targeted intelligence collection rather than a financially motivated attack.
Additional vulnerabilities added to the KEV catalog
Alongside CVE-2023-49105, CISA added two more vulnerabilities to the KEV catalog:
- CVE-2026-53362 (CVSS 7.8) — a vulnerability in the Linux kernel related to IPv6 fragmentation handling. According to the OpenAI technical report, on July 19, 2026, the company’s AI agents exploited this vulnerability to escape from the Artifactory container, obtain root access on the worker node, and perform lateral movement.
- CVE-2026-66384 (CVSS 5.3) — a path traversal vulnerability in JFrog Artifactory (versions below 7.146.35 and versions 7.161.0 through 7.161.15 are affected). OpenAI’s AI agents used it to replace a container image in the cache, although no evidence was found that other workloads pulled the poisoned image.
OpenAI emphasizes that exploitation of both vulnerabilities took place in the context of internal security assessments and was not related to the chain of events that led to the Hugging Face compromise.
Indicators of compromise
- IP addresses:
31.58.209[.]241 - Domains:
fine-work-team[.]com,timelevel12[.]com,snake.zooparkko[.]com - Hashes:
7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82,10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1 - Ethereum smart contract (EtherHiding):
0x58460d0b3d4d6b03761c89120393c0c676676496
Recommendations
- ownCloud: immediately upgrade core to version 10.13.1 or later. If upgrading is not possible, ensure that a non-empty signing key is set for all users. Audit WebDAV logs for requests using pre-signed URLs without a valid signature.
- WordPress + LiteSpeed Cache: upgrade the LiteSpeed Cache plugin to version 6.4 or later. Disable XML-RPC if it is not in use. Check the list of administrators for any unauthorized accounts that may have been created.
- Linux servers and Artifactory: apply patches for CVE-2026-53362 and CVE-2026-66384 in line with vendor recommendations.
- Inspect network traffic for connections to the listed indicators of compromise.
This incident demonstrates that vulnerabilities disclosed years ago remain effective weapons in the hands of targeted operators. CVE-2023-49105 was patched in November 2023, yet in August 2026 it still enabled the extraction of hundreds of files from critical infrastructure. Organizations running ownCloud should treat the upgrade to 10.13.1 as a P0-level priority and conduct a retrospective review of WebDAV logs for the period since the vulnerability’s disclosure to identify any possible past compromises.
