# Critical ownCloud Vulnerability Added to U.S. Government’s Known Exploited Catalog After Cyberattack on Philippine Nuclear Facility
Federal cybersecurity authorities have escalated a severe vulnerability in the ownCloud collaboration platform to their list of actively exploited threats, following intelligence that a threat actor with Chinese-language ties compromised a government-affiliated nuclear research organization in the Philippines.
## The Vulnerability at a Glance
The security flaw, designated CVE-2023-49105, carries a critical severity rating of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS). It is classified as a WebDAV API authentication bypass that affects the core editions of ownCloud running between versions 10.6.0 and 10.13.0. The flaw was originally reported by ownCloud’s own security team in November 2023 and was addressed in version 10.13.1.
What makes this vulnerability particularly dangerous is its exploitation path. When a user on an ownCloud instance has not configured a signing key — which happens to be the default setup — an attacker who already knows the target’s username can craft specially signed WebDAV requests that the server treats as legitimate authentication actions. This means no actual login credentials are needed, effectively granting the attacker full access to read, alter, or remove any file stored on the compromised system.
## The Philippine Attack Campaign
The urgency behind the government’s decision to add this vulnerability to its catalog of known exploited flaws stems from a detailed investigation conducted by the cybersecurity firm Hunt.io. Researchers discovered that an open directory hosted on a remote server was being used as a staging ground for malicious activity targeting organizations in the Philippines.
On the server, investigators found a collection of custom-built Python scripts alongside well-known open-source offensive security frameworks including Sliver, Metasploit, and Mettle. These tools were used in coordinated strikes against two Philippine entities: a nuclear research institution and a marine engineering and shipbuilding firm with contractual ties to the country’s naval forces.
The attack on the nuclear research body specifically leveraged the ownCloud flaw. The adversary generated pre-signed URLs with an empty signing secret, enabling them to pull files from the platform without any authentication whatsoever. Five distinct Python scripts were identified as implementing this exploit, with four scripts tailored to target individual accounts and one script designed to systematically scan the WebDAV directory and log every file retrieval attempt.
## Scope of the Data Exfiltration
The scope of the data theft was substantial. Analysts estimate that the threat actor successfully downloaded 176 files amounting to roughly 372 megabytes from the nuclear research organization. The stolen materials included:
– Records pertaining to nuclear material accounts
– Draft strategic planning documents spanning 2023 to 2028
– Research reactor core components and related schematics
– Historical fuel inventory data
– Internal presentations and employee personal records
– A 192-megabyte SQL export from a ZKTeco BioTime attendance and personnel management system
– Sensitive credential stores including BitLocker encryption keys, a KeePass password database, and files encrypted with AxCrypt
Evidence gathered during the investigation strongly pointed toward a Chinese-speaking threat actor. Indicators included simplified Chinese text embedded in source code comments, function descriptions, log outputs, and folder structures used to organize the stolen data.
## A Second Target: The Marine Engineering Firm
In a parallel operation, the same threat actor also breached a WordPress website managed by the marine engineering and shipbuilding company. Two separate attack vectors were employed here. First, the attackers exploited CVE-2024-28000, a critical vulnerability in the LiteSpeed Cache plugin for WordPress, also rated 9.8 on the CVSS scale. This gave them elevated privileges on the site.
Second, a script named “brute_xmlrpc.py” found on the same staging server was designed to carry out XML-RPC brute-force attacks against the same WordPress installation, providing an alternative pathway to compromise even without exploiting the LiteSpeed flaw.
## Additional Compromise Discovered
During deeper analysis of the WordPress site’s source code, researchers uncovered an additional, potentially unrelated compromise mechanism. This attack chain used a technique known as EtherHiding to pull HTML content from an Ethereum smart contract and serve it as a Google verification page — a common tactic in so-called ClickFix social engineering schemes. When users interacted with the lure, it triggered the execution of “pcalua.exe,” which in turn invoked “mshta.exe” to download and run a Visual Basic Script (VBScript) dropper designed to deliver further malicious payloads.
## Broader Government Response
The inclusion of CVE-2023-49105 in the Known Exploited Vulnerabilities catalog is part of a broader sweep of government action. On the same day, CISA added two additional vulnerabilities to the catalog after OpenAI disclosed that its AI-powered agents had been used to exploit flaws in the Linux Kernel (CVE-2026-53362) and JFrog Artifactory (CVE-2026-66384) during internal security testing conducted the previous month. OpenAI clarified that these activities were independent of and did not contribute to a separate compromise event involving the Hugging Face platform.
Federal Civilian Executive Branch agencies are now required to remediate the ownCloud and Linux Kernel vulnerabilities by August 30, 2026, while the Artifactory flaw must be patched by September 10, 2026.
## Frequently Asked Questions (FAQ)
**What is CVE-2023-49105?**
CVE-2023-49105 is a WebDAV API authentication bypass vulnerability in ownCloud that allows unauthenticated attackers to access, modify, or delete files on a server when they know a valid username and the target user has not configured a signing key — which is the default configuration.
**Who was behind the attacks on the Philippine organizations?**
Investigators attributed the attacks to a Chinese-speaking threat actor based on linguistic evidence found in the attackers’ code, including simplified Chinese comments, log entries, and folder naming conventions used to store stolen data.
**Which organizations were targeted?**
The primary targets were a nuclear research body in the Philippines and a marine engineering and shipbuilding company that provides services to the Philippine Navy.
**What data was stolen from the nuclear research body?**
The stolen data included nuclear material account records, strategic planning documents, reactor component details, fuel inventories, employee personal information, an attendance database dump, and various credential stores such as BitLocker keys and encrypted password databases.
**How did the attackers exploit the ownCloud vulnerability?**
The attackers used custom Python scripts to generate pre-signed WebDAV URLs with an empty signing secret, allowing them to retrieve files from the server without needing to supply any authentication credentials.
**Was the WordPress site compromised through the same vulnerability?**
No. The WordPress site was targeted using a different vulnerability — CVE-2024-28000 in the LiteSpeed Cache plugin — as well as a brute-force XML-RPC attack. However, the same threat actor group was believed to be responsible for both campaigns.
**What is the Known Exploited Vulnerabilities (KEV) catalog?**
The KEV catalog is maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and lists security flaws that are known to be actively exploited in real-world attacks. Federal agencies are required to patch listed vulnerabilities by specific deadlines.
**What other vulnerabilities were added to the KEV catalog alongside the ownCloud flaw?**
Two additional vulnerabilities were added on the same day: CVE-2026-53362 impacting the Linux Kernel and CVE-2026-66384 impacting JFrog Artifactory. Both were discovered during internal testing by OpenAI.
**What should organizations do to protect themselves?**
Organizations running ownCloud should immediately upgrade to version 10.13.1 or later. They should also ensure that all signing keys are properly configured for all user accounts, enable multi-factor authentication, and monitor for unauthorized WebDAV access attempts.
## Conclusion
The addition of CVE-2023-49105 to the Known Exploited Vulnerabilities catalog underscores the real and present danger posed by authentication bypass flaws in widely used collaboration and file-sharing platforms. The targeted attack on a nuclear research institution in the Philippines, coupled with a parallel strike against a defense-adjacent marine engineering firm, illustrates the strategic intent behind the campaign and the high value that threat actors place on sensitive government and military-adjacent data.
The speed at which the U.S. government moved to mandate remediation reflects the seriousness with which agencies are now treating actively exploited vulnerabilities, particularly when they have been weaponized against critical infrastructure and national security interests. Organizations worldwide are urged to treat these findings as a call to action — patching systems promptly, enforcing proper cryptographic configurations, and maintaining vigilant monitoring for signs of unauthorized access.
The broader addition of the Linux Kernel and Artifactory vulnerabilities to the catalog further reinforces the need for continuous vulnerability management and rapid patch deployment across all federal and enterprise environments.
Thank you for reading
