On 27 August 2026 CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog with a deadline of 30 August. The bug is almost three years old. It was disclosed by ownCloud in November 2023, so the listing is a reminder that old flaws on unpatched servers keep working.
The same week, hunt.io published a report, dated 26 August 2026, on an operator server it found through an open directory. The report says a likely Chinese speaking operator used the flaw to pull files from an internet facing ownCloud instance run by a Philippine nuclear research agency.
What's affected
ownCloud core 10.6.0 through 10.13.0. NVD says the fix is in 10.13.1, and it scores the issue 9.8 under CWE-287. The ownCloud advisory classes it as improper initialization (CWE-665). The hunt.io write-up recommends 10.13.3 or later, so use the newest release.
Anyone who knew a valid username could read, change or delete that user's files without a password, if that user had no signing key configured. No signing key was the default.
How the bug works
ownCloud's WebDAV API supports pre-signed URLs. When a user had no signing key, the signing routine used an empty secret. Hunt.io's analysis points at an empty bytes literal used as the PBKDF2 salt, which means anyone could compute a valid signature. The server then accepted a request signed that way as coming from the user.
According to hunt.io, the operator wrote five Python scripts around this, added random delays between requests to avoid volume based detection, and used PROPFIND requests to list directories. The report counts about 176 files (roughly 372 MB) retrieved across five folders, including personnel records and credential material such as a KeePass database. A CSV file in the directory referenced roughly 9 GB of data, which hunt.io takes as a sign of an earlier compromise.
How to check if you're exposed
sudo -u www-data php occ status
The output shows the installed version. If it is below the current release, plan an upgrade now. Then look for the access pattern from the report, a single client enumerating and fetching files for many different users:
grep '"PROPFIND ' /var/log/apache2/access.log* | awk '{print $1}' | sort | uniq -c | sort -rn | head
One address with thousands of PROPFINDs across many accounts is the signal. Check for open directories on your own servers as well, since this operator's tooling was found because of one.
A timeline worth keeping
| Date | Event |
|---|---|
| 21 Nov 2023 | ownCloud publishes its advisory; NVD publishes the CVE record |
| 13 Aug 2026 | hunt.io identifies the operator's open directory |
| 25 Aug 2026 | hunt.io publication, after disclosure to CERT-PH |
| 26 Aug 2026 | hunt.io report dated |
| 27 Aug 2026 | CISA adds CVE-2023-49105 to KEV, due 30 Aug |
The CISA deadline gave federal agencies three days. For a bug this old, the vendor fix had been public for almost three years. The only thing that changed in August 2026 is that someone was seen using it.
A smaller detail from the report is worth copying into your own detection notes. The scripts took a known username as input. They did not guess passwords, so there were no failed login events to alert on. Detection has to rely on the shape of the traffic: signed WebDAV requests with no prior login, PROPFIND bursts, and one source touching many accounts.
What to do now
- Upgrade ownCloud to the latest 10.x release.
- Configure a signing key for every user who uses pre-signed URLs.
- Review WebDAV access logs from the whole period the server ran an old version, not just recent weeks.
- Rotate the passwords and recovery keys of anyone whose files were stored there, including password manager databases.
- Take file sharing servers off the open internet where you can, and use a VPN or an authenticating proxy.
How this could have been avoided
- Patch on a schedule, then verify. A 2023 fix still being exploited in 2026 is an update gap, not a new bug.
- No empty secrets, ever. The signing key defaulted to nothing. Secure defaults generate a random key on first start and fail closed when one is missing.
- Do not store credential files in shared repositories. The haul included a password database and a recovery key. A secrets manager keeps those out of a general file share.
- Alert on enumeration. PROPFIND bursts from one client across many users are rare in normal use.
- Check your external surface for exposed directories. The operator's own server leaked their scripts and logs.
Why it matters
The KEV catalog is not only about fresh vulnerabilities. Each listing is evidence that someone is using that flaw now, and old ones show where patching stopped.
What to put in an incident review
If you ran an affected version with internet exposure, the useful questions are narrow. Which users had no signing key set? Which of them held sensitive files? Was the WebDAV endpoint reachable from outside at any point? Hunt.io found data that suggested an earlier compromise of the same server, so do not stop at the date you patched. Look back to the oldest logs you keep, and write down what you cannot see. Gaps in logging belong in the report as findings, because an auditor or a customer will ask about them.
Make a short list of what was stored in the share, including password databases, recovery keys and HR files, and treat each as disclosed until you can prove otherwise. Tell the owners of those files early, since they are the people who can change a password or reissue a key.
Try it yourself
Take your list of internet facing services and check the version of each against its vendor's current release. Anything more than a year behind goes on a patching list this week.
Click through it at your own pace, or open it full screen.
You can also see which CVEs carry KEV status on the Gold KEV list.
Quick check
Why could an attacker sign requests for a user?
The user had no signing key configured, which was the default, and the signing routine then used an empty secret that anyone could reproduce.
Why does a 2023 CVE appear in a 2026 KEV addition?
KEV records exploitation in the wild, whatever the CVE's age. Unpatched servers keep the old bug alive.
