The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines.
The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of WebDAV API authentication bypass that could allow an attacker to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured, which is the default configuration.
Disclosed by ownCloud in November 2023, the issue impacts “core” versions from 10.6.0 through 10.13.0. It was fixed in version 10.13.1.
CISA’s addition of the flaw to the KEV catalog comes a couple of days after Hunt.io said it identified an open directory on the host “31.58.209[.]241,” which staged custom Python scripts, open-source offensive security tooling such as Sliver, Metasploit, and Mettle, and exfiltrated data from two Philippine organizations, including a nuclear research body and a marine engineering and shipbuilding company that provides services to the Philippine Navy.
“The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV,” Hunt.io said.
A separate intrusion is said to have exploited a WordPress site managed by the marine engineering and shipbuilding company. The threat intelligence firm attributed the attacks to a Chinese speaker due to the presence of simplified Chinese in source code comments, docstrings, log output, and folders used to sort stolen data.
Five custom Python scripts present in the exposed directory have been found to implement an exploit for CVE-2023-49105, allowing an attacker who is in possession of valid usernames on an ownCloud instance to obtain unauthorized access without having to supply the credentials themselves.
“An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as an authentication action by that user, without ever supplying credentials,” Hunt.io said.
Of the five scripts, four target a single account each, while the fifth script includes steps to enumerate the WebDAV directory and log every download attempt. In all, the threat actor is estimated to have downloaded 176 files totaling about 372 MB from the nuclear research entity and stored them across five staging directories.
This includes nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core components, historical fuel inventories, and presentation material, employee personal information, a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database, and credentials stores, such as BitLocker keys, a KeePass database, and AxCrypt-encrypted files.
In tandem, the threat actor has also exploited a critical flaw in the LiteSpeed Cache plugin for WordPress (CVE-2024-28000, CVSS score: 9.8) to obtain elevated access to the WordPress site operated by another Philippines company. Separately, a Python script (“brute_xmlrpc.py”) identified in the open directory targets the same site with an XML-RPC brute-force attack to guess account credentials, thereby giving the attackers a pathway independent of CVE-2024-28000.
Further analysis of the WordPress source code has unearthed an active, possibly unrelated compromise that leverages EtherHiding to extract HTML content from an Ethereum smart contract and ultimately serve a Google verification page that’s common in ClickFix-style attacks. The lure, for its part, launches “pcalua.exe” to invoke “mshta.exe” and download a Visual Basic Script (VBScript) dropper.
“The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations,” Hunt.io said. “The marine engineering firm’s ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority.”
In light of active exploitation of CVE-2023-49105, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by August 30, 2026.
On Thursday, CISA also added two other flaws – each impacting Linux Kernel (CVE-2026-53362) and Artifactory (CVE-2026-66384) – to the KEV catalog after OpenAI revealed that its artificial intelligence (AI) agents exploited both of them to target its own internal infrastructure last month.
“These activities were not part of, and did not contribute to, the chain of events that led to the Hugging Face compromise,” OpenAI said in a technical explainer released this week. Federal agencies have time till August 30, 2026, to patch the Linux Kernel vulnerability and till September 10, 2026, to plug the Artifactory bug.