Nuclear Records Stolen via ownCloud Flaw, CISA KEV Added

CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on August 27, 2026. The remediation deadline for federal agencies is August 30: tomorrow.

The trigger for the KEV addition was a confirmed incident: a Chinese-speaking threat actor used this flaw to access and steal nuclear-related records from a research body in the Philippines. This is not a theoretical risk. The attack happened.

The vulnerability

CVE-2023-49105 is an improper authentication flaw in ownCloud. If an attacker knows a target user’s username and that user has no signing-key configured, the attacker can read, modify, or delete any of that user’s files without authentication. NVD rates it CVSS 9.8 (Critical). EPSS probability sits at 41%, which is high for a file-sharing vulnerability.

The flaw is in the ownCloud core file-access layer. No credentials are needed beyond knowing a username. A misconfigured or default installation missing signing-key enforcement is fully exposed.

Who is at risk

Any self-hosted ownCloud deployment where user accounts do not have signing-keys configured. This is a common default state in older deployments and in organizations that provisioned accounts quickly without running through hardening checklists.

SaaS/hosted ownCloud is a separate question; check with your provider to confirm whether they applied the patch and when.

What to do now

1. Update ownCloud immediately. The patch for CVE-2023-49105 is in ownCloud 10.13.1 or later. Apply it.
2. Audit signing-key configuration. Every user account should have a signing-key configured. The NVD advisory links to the ownCloud security bulletin with specifics.
3. Review access logs. Look for unauthenticated or anomalous file-access events from August 2026 back as far as your retention allows. The EPSS score suggests opportunistic exploitation beyond the Philippines incident is likely.
4. If you cannot patch immediately: disable public-facing file access or restrict access by IP while you schedule maintenance.

Federal agencies and their contractors operate under BOD 26-04 and are required to remediate by August 30.

Context

The Philippines targeting is the kind of incident that explains why CISA’s KEV process exists. An old vulnerability, not new, used in a targeted operation against a high-value institution. The three-day CISA remediation window reflects how seriously they are treating this.

ownCloud has been a common lateral-movement target in enterprise environments where it holds HR data, project files, and in research contexts like this one, sensitive technical documents. The same class of unauthenticated bypass bugs appeared in several competing file-sync platforms in 2023 and 2024. Organizations that patched at the time are clean here; organizations that deferred are not.

See the CISA KEV catalog and the CVE-2023-49105 entry for full remediation guidance. For broader context on how KEV works and why it matters, see What Is the CISA KEV Catalog?.