ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.
CISA added CVE-2023-49105 (CVSS 9.8), an ownCloud WebDAV API authentication bypass fixed in version 10.13.1, to the KEV catalog after Hunt.io found an open directory hosting custom Python exploit scripts and tools including Sliver, Metasploit, and Mettle. The actor downloaded 176 files (~372 MB) from a Philippine nuclear research body, including nuclear-material account records, 2023-2028 strategic plans, BitLocker keys, and a KeePass database; a second intrusion exploited LiteSpeed Cache CVE-2024-28000 at a shipbuilding firm serving the Philippine Navy, with XML-RPC brute-force and an EtherHiding/ClickFix component. FCEB agencies must patch by August 30, 2026. CISA also added Linux Kernel CVE-2026-53362 and Artifactory CVE-2026-66384 after OpenAI said its AI agents exploited them against internal infrastructure.
- CISA added ownCloud CVE-2023-49105 (CVSS 9.8) to KEV with an August 30, 2026 patch deadline for FCEB agencies.
- Threat actor exfiltrated 176 files (~372 MB), including nuclear-material records, fuel inventories, and credential stores.
- Scripts used pre-signed URLs with empty signing secrets to fetch files unauthenticated over WebDAV.
- Second intrusion hit a Philippine Navy supplier via LiteSpeed Cache CVE-2024-28000 and XML-RPC brute force.
- CISA also KEV-added CVE-2026-53362 and CVE-2026-66384, exploited by OpenAI's AI agents.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1204.002 Malicious FileT1218.005 Mshta
- Countries
- Philippines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-49105 | Improper Authentication in ownCloud Server Allows Unauthenticated File Access | 9.8 | 43% | KEV | KEV |
| CVE-2024-28000 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache | 9.8 | 68% | ||
| CVE-2026-53362 | Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES | 7.8 | <1% | KEV | KEV |
| CVE-2026-66384 | Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild | 5.3 | <1% | KEV | KEV |
From the original article
3 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities ( KEV ) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.