The bug itself is almost elegant in how little it asks of an attacker. ownCloud's pre-signed URL feature lets a file owner generate a link that authenticates a request without a username or password, using a signature computed from a per-account signing key. The flaw is what happens when that signing key was never configured, which for years was the default state for a lot of installations: rather than rejecting an unsigned request, the server would accept a signature computed against an empty secret. According to the scripts Hunt.io recovered from the operator's own staging server, that meant generating a valid PBKDF2-SHA512 hash using b"" as the key, attaching it to a WebDAV request for a known username, and reading or writing that account's files with no credentials at all. ownCloud disclosed the flaw and shipped 10.13.1 on 21 November 2023, three years before it reached CISA's exploited list this week.
Why "patched since 2023" and "actively exploited in 2026" aren't a contradiction
A three-year gap between fix and KEV listing sounds like it should be impossible, but CVE-2023-49105 fits a pattern that keeps showing up in internet-facing self-hosted software: patch availability and patch adoption are two different curves, and the second one can lag the first by years on unmanaged or forgotten installations. Hunt.io's report doesn't say when the Philippine Nuclear Research Institute's ownCloud instance was last updated, only that it was still running a vulnerable version and internet-facing when the operator found it. The institute is a legitimate, ongoing target for anyone interested in nuclear material tracking or research-reactor operations - it isn't obscure - which makes the gap between "a fix exists" and "the fix reached every place that needed it" the actual story here, more than the vulnerability itself.
What the operator actually took
Hunt.io's Attack Capture tooling found the operator's open staging directory on 13 August, hosted on a VPS in Amsterdam running a Python SimpleHTTP server alongside Sliver, Metasploit and Mettle command-and-control frameworks and a custom ELF loader the operator called multi_backupd. The material retrieved from the institute's WebDAV endpoint totalled around 372MB across five organised folders: research-reactor core-component databases, fuel inventory records and radiation-safety documentation, alongside staff personal data sheets, financial disclosure forms, passport scans, BitLocker recovery keys and KeePass password databases. A CSV file left on the staging server suggests the operator had actually pulled closer to 9GB in total - the visible staged data was a curated subset, not the full haul. A separate 192MB SQL dump from a biometric attendance system covering multiple Philippine science agencies points to interest in tracking personnel across the sector, not just this one institute.
The same operator, a second target, a different bug entirely
Hunt.io's report also ties the same staging infrastructure to a compromise of a Philippine marine engineering firm that provides services to the Navy, reached this time through two WordPress flaws rather than ownCloud: a custom Go exploit against a weakly-seeded LiteSpeed Cache security hash (CVE-2024-28000) that brute-forced an admin account in under four hours, and a straightforward XML-RPC credential-stuffing run using the rockyou.txt wordlist. Attributed with medium confidence to a Chinese-speaking operator based on code comments and folder naming, the campaign reads less like a single opportunistic hit and more like patient, per-target collection - purpose-built scripts, curated output folders, and a clear preference for known, public vulnerabilities over anything novel.
Why CISA's 72-hour deadline lands on a bug this old
CISA's KEV addition on 27 August comes with the standard three-day window that applies once a vulnerability meets the catalog's active-exploitation bar, regardless of how long the underlying fix has existed - the deadline is about confirmed real-world use, not the CVE's age. For federal agencies, and for anyone else still running an unpatched ownCloud instance, the practical task isn't finding a fix; it's confirming that a three-year-old advisory was actually acted on, which is a very different exercise from responding to a new zero-day. Cyber Security News' summary of the campaign makes the same point about the naval contractor hit alongside it: neither victim was breached through anything novel.
- Confirm every internet-facing ownCloud Server instance is on 10.13.1 or later - if you can't confirm the version quickly, treat it as unpatched.
- Check whether signing keys are configured for every account, not just admin accounts; the flaw specifically targets users without one set.
- Review WebDAV access logs for pre-signed URL requests against accounts that never generated one themselves.
- Treat this as a prompt to audit any other internet-facing collaboration or file-sharing software against its own multi-year-old advisories, not just ownCloud.
- If the instance held sensitive material and its patch history is unclear, rotate credentials and any secrets it had access to rather than assuming the update alone closes the exposure.
A three-year gap between a fix shipping and a breach making the news is a patch management failure story wearing a nation-state attribution headline. If you'd like help auditing self-hosted file-sharing or collaboration platforms against their own advisory backlog, email sales@halfteck.com.