ownCloud and Ecosystem — Cyber Espionage Campaign Exploits Critical Vulnerabilities to Exfiltrate Sensitive Intelligence (CVE-2023-49105)

Publication date: August 28, 2026
Category: Threat Intelligence / Cyber Espionage

Introduction

In late August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the critical vulnerability CVE-2023-49105 to its Known Exploited Vulnerabilities (KEV) catalog. This action followed discoveries that a Chinese-speaking cyber espionage threat actor weaponized the flaw to infiltrate a nuclear research body and a marine engineering firm in the Philippines. The campaign highlights a calculated targeting strategy against critical infrastructure and defense entities in Southeast Asia, supplemented by the exploitation of multiple auxiliary vectors across web servers and container platforms, including recent flaws associated with AI agents and system kernels.

What is ownCloud and Associated Threats? (General Analysis)

ownCloud is an open-source Enterprise File Synchronization and Sharing (EFSS) software platform widely deployed by academic, governmental, and corporate institutions to manage self-hosted cloud storage environments.

At the core of the incident lies CVE-2023-49105, a critical authentication bypass vulnerability in ownCloud’s WebDAV API affecting core versions 10.6.0 through 10.13.0. Its severity is underpinned by official NVD verified metrics:

  • Official CVSS Vector (CVSS v3.1): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Score: 9.8 (CRITICAL).
  • Official CWE Classification: CWE-287 (Improper Authentication).
  • CISA KEV Catalog: Yes (confirmed).

Additionally, the documented campaign involves other critical vectors identified across victim infrastructure or recent concurrent incidents:

  • CVE-2024-28000: Incorrect Privilege Assignment vulnerability in the WordPress LiteSpeed Cache plugin (CVSS 9.8, CWE-266).
  • CVE-2026-53362: Linux kernel vulnerability involving UDPv6 fragment accounting and MSG_SPLICE_PAGES (CVSS 7.8, CWE-787 / CWE-122, in CISA KEV).
  • CVE-2026-66384: Path Traversal flaw in JFrog Artifactory under specific remote-repository conditions (CVSS 5.3, CWE-22, in CISA KEV).

How Does It Work? (Technical Analysis)

The intrusion campaign combines reconnaissance, application-layer authentication bypass, and default configuration abuse to achieve silent data exfiltrations:

  • ownCloud Exploitation Flow (CVE-2023-49105): The flaw resides in the pre-signed URL subsystem. When a legitimate user lacks a configured custom signing key—the default out-of-the-box configuration across installations—the server accepts arbitrarily signed WebDAV requests if the victim’s username is known. Attackers deployed custom Python scripts to forge valid WebDAV requests without providing credentials, gaining unrestricted access to file trees.
  • Persistence and Exfiltrated Assets: An exposed directory (31.58.209[.]241) was found staging attack scripts alongside open-source offensive frameworks such as Sliver, Metasploit, and Mettle. The threat actor downloaded 176 files totaling ~372 MB from the nuclear entity, including nuclear-material account records, strategic plans, research reactor components, historical fuel inventories, and personnel database dumps.
  • Auxiliary Vectors: On the marine engineering firm’s infrastructure, attackers exploited CVE-2024-28000 in WordPress to achieve unauthenticated privilege escalation, paired with brute-force attacks against XML-RPC endpoints (brute_xmlrpc.py). Furthermore, malware delivery mechanisms leveraging EtherHiding and ClickFix-style redirection frameworks were detected.

Affected Systems / Environments

Impacted software components and platforms across this threat cycle include:

  • ownCloud Core: Versions 10.6.0 through 10.13.0 (patched in version 10.13.1).
  • WordPress LiteSpeed Cache: Versions up to and including 6.3.0.1.
  • Linux Kernel: Versions supporting MSG_SPLICE_PAGES in IPv6 networking stacks vulnerable to paged buffer miscalculations.
  • JFrog Artifactory Self-Managed: Versions exposed to remote Docker repository path traversal conditions.
CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2023-49105 CWE-287 (Improper Auth) Critical / Exfiltration 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2024-28000 CWE-266 (Privilege Assignment) Critical / Privilege Escalation 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-53362 CWE-787 / CWE-122 (Out-of-bounds Write) High / Kernel Code Execution 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-66384 CWE-22 (Path Traversal) Medium / Out-of-bounds Write 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Mitigation and Detection

Remediation

  • ownCloud Patching: Immediately upgrade to version 10.13.1 or higher, ensuring proper configuration and rotation of signing keys for WebDAV pre-signed URLs.
  • Ecosystem and OS Patches: Update the LiteSpeed Cache plugin beyond version 6.3.0.1, apply stable Linux kernel patches addressing CVE-2026-53362, and update JFrog Artifactory according to vendor advisories.
  • Directory Hardening: Disable unnecessary administrative endpoints exposed to the public internet (such as WordPress XML-RPC) and restrict access to temporary staging directories.

Detection

  • Monitor WebDAV server access logs for anomalous requests accessing multiple user resources without an explicit prior authentication phase (Authorization headers absent or manipulated in pre-signed URLs).
  • Audit temporary web directories and staging partitions for indicators of offensive command tools (Sliver, custom Python exfiltration scripts).

Intelligence Note: The active exploitation of authentication bypass flaws in document repositories underscores the necessity of enforcing strict network segmentation and deep packet inspection for HTTP/WebDAV traffic to safeguard scientific research and defense assets.

Wrapping Up

The targeted campaign against nuclear research and defense entities in the Philippines demonstrates how cyber espionage actors exploit known vulnerabilities in document collaboration platforms (ownCloud) and CMS frameworks (WordPress), compounded by OS kernel and container infrastructure flaws. The inclusion of these flaws into CISA’s KEV catalog reinforces the urgency of rigorous patch management and robust defensive visibility to prevent large-scale exfiltration of state and industrial secrets.

References