An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV

On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. The most severe is CVE-2023-49105, an authentication flaw in ownCloud with a CVSS score of 9.8. The addition follows documentation by Hunt.io of a campaign that targeted a nuclear research institute in the Philippines.

Theft from a Philippine Nuclear Research Institute

A Chinese-speaking actor exploited the flaw to exfiltrate approximately 176 files, totaling 372 MB, from an ownCloud instance managed by a Philippine nuclear research institute. The stolen data includes nuclear material logs, drafts of strategic plans for 2023–2028, components of the core of a research reactor, and historical fuel inventories. Employee personal information, a 192 MB SQL dump of the ZKTeco BioTime attendance database, and credential stores with BitLocker keys, a KeePass database, and files encrypted with AxCrypt also ended up in the attacker's hands.

The infrastructure used for exfiltration was identified on the host 31.58.209[.]241. An open directory on that host contained custom Python scripts, open-source offensive tools such as Sliver, Metasploit, and Mettle, and data stolen from the two affected Philippine organizations. Hunt.io attributes the operation to a Chinese-speaking actor based on comments in simplified Chinese in code, docstrings, logs, and folders used to organize the data. No state affiliation has been confirmed.

The same actor also compromised the WordPress site of a naval engineering company that provides services to the Philippine Navy. According to Hunt.io, the two targets reflect interests consistent with tensions in the South China Sea.

How CVE-2023-49105 Works: Missing Authentication on Pre-Signed URLs

CVE-2023-49105 is an improper authentication vulnerability (CWE-287) in ownCloud server. It has a CVSS score of 9.8 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. An attacker can access, modify, or delete any file without authentication if they know the victim's username and the victim has not configured a signing key. The issue arises because pre-signed URLs are accepted even when no signing key is configured for the file owner.

Affected versions range from 10.6.0 to 10.13.0. The fixed version is 10.13.1.

The attack against the Philippine nuclear institute exploited exactly this mechanism. Five Python scripts implement the exploit: four target a single account each, the fifth enumerates the WebDAV directory and logs every download attempt. The attackers generated pre-signed URLs with an empty signing secret, thereby achieving unauthenticated file retrieval via WebDAV.

CISA added CVE-2023-49105 to the KEV on August 27, 2026. The remediation deadline for U.S. Federal Civilian Executive Branch (FCEB) agencies is August 30, 2026. This vulnerability also requires the forensic triage outlined in BOD 26-04: you must check whether the system has been compromised before applying the patch.

The Other Two CVEs in the KEV and the Role of OpenAI AI Agents

Alongside ownCloud, on August 27 CISA also added CVE-2026-53362 in the Linux kernel and CVE-2026-66384 in JFrog Artifactory to the KEV.

CVE-2026-53362 has a CVSS of 7.8 and involves an out-of-bounds write or heap-based buffer overflow in __ip6_append_data() in the IPv6 subsystem. CISA describes it as a vulnerability that can allow privilege escalation. Affected versions are those prior to 6.1.177. Forensic triage is also required for this flaw, and the FCEB deadline is August 30, 2026.

CVE-2026-66384 in JFrog Artifactory has a CVSS of 5.3 and allows an authenticated user to write data outside the intended Docker cache path under specific conditions related to remote repositories. Affected versions are those prior to 7.146.35. Here forensic triage is not required, and the FCEB deadline is September 10, 2026.

A relevant detail: OpenAI disclosed that its own artificial intelligence agents exploited CVE-2026-53362 and CVE-2026-66384 against its own internal infrastructure in the month preceding publication. The company clarified that these activities did not contribute to the chain of events that led to the compromise of Hugging Face.

The Second Intrusion: WordPress, LiteSpeed Cache, and a ClickFix Dropper

The campaign against the Philippines was not limited to ownCloud. Against the WordPress site of the naval engineering company, the actor exploited CVE-2024-28000 in LiteSpeed Cache. This is an improper privilege assignment vulnerability with a CVSS of 9.8, affecting versions up to 6.3.0.1 and fixed in 6.4.

In parallel, a Python script named brute_xmlrpc.py conducted XML-RPC brute-force attacks against the same site to guess credentials. Analysis of the WordPress source code also revealed an active, possibly unrelated, compromise based on EtherHiding. This mechanism extracts HTML content from an Ethereum smart contract and serves a Google verification page typical of ClickFix attacks. The lure launches pcalua.exe to invoke mshta.exe and download a VBScript dropper.

CVE-2024-28000 does not appear in the KEV catalog.

What to Do Now: Patches, Deadlines, and Indicators

The concrete actions are clear.

For ownCloud: update to version 10.13.1 or later. The deadline for U.S. federal agencies is August 30, 2026, and forensic triage is mandatory.

For the Linux kernel: update to version 6.1.177 or higher, or apply vendor mitigations. Deadline August 30, 2026, forensic triage required.

For JFrog Artifactory: update to version 7.146.35 or later. Deadline September 10, 2026, forensic triage not required.

For LiteSpeed Cache: update the plugin to version 6.4 or later.

The indicator 31.58.209[.]241 can be used to check for traffic or contacts to the malicious host. The presence of Python scripts that generate pre-signed WebDAV URLs with an empty secret is a specific signal of CVE-2023-49105 exploitation.

CISA recommends that all organizations, including non-federal ones, prioritize remediation of vulnerabilities in the KEV and adopt risk-based management.

A Rapidly Moving KEV

The August 27 addition is not an isolated event. In the preceding days, CISA added several other actively exploited vulnerabilities to the catalog. On August 26, CVE-2019-1068 in Microsoft SQL Server (deadline August 29), CVE-2026-8452 in Citrix NetScaler ADC and Gateway (deadline August 29), CVE-2022-0995 in the Linux kernel (deadline September 9), and others in Red Hat ABRT, libuser, and AjaxPro were added. On August 25, CVE-2026-60004 in Gitea was added, with a deadline of August 28. On August 24, CVE-2026-21962 in Oracle HTTP Server and WebLogic Server Proxy Plug-in was added, with a deadline of August 27.

For the Linux kernel, this is the second addition in two days: CVE-2022-0995 on August 26 and CVE-2026-53362 on August 27. Some deadlines have already passed, such as the one for Gitea (August 28) and Oracle (August 27). For organizations that have not yet applied the patches, time has already run out.