Old CVEs Still Being Exploited: CVE-2023-49105, ownCloud Authentication Bypass Still Active in 2026

CVE Summary

Field	Details
CVE ID / CVSS Score	CVE-2023-49105, CVSS 9.8 (Critical)
Affected Product / Vendor	ownCloud Server (core), ownCloud
Vulnerability Class / CWE	Improper Authentication, CWE-287
Original Disclosure Date	November 21, 2023
Years Since Disclosure	Approximately 3 years
Current Exploitation Status	Actively exploited. Added to CISA's Known Exploited Vulnerabilities catalog on August 27, 2026, following public reporting of a nation-state-linked intrusion.
Associated Threat Actors	A suspected Chinese-speaking operator, not attributed to a specific named group at this time

Sourcing and Methodology Note

The original disclosure and patch history for this post come from ownCloud's own security advisory, titled "WebDAV API Authentication Bypass using Pre-Signed URLs," published November 21, 2023, alongside the National Vulnerability Database record for CVE-2023-49105.

Confirmation that exploitation is happening now, not merely that the flaw remains theoretically exploitable, comes from CISA's Known Exploited Vulnerabilities catalog, which added CVE-2023-49105 on August 27, 2026 under Binding Operational Directive 26-04, with a federal remediation deadline of August 30, 2026, citing evidence of active exploitation. That catalog addition followed, by one day, the public disclosure of a specific intrusion against a Philippine research organization, reported independently by multiple security news outlets in the same week, all describing the same underlying incident and attributing the original technical discovery to threat intelligence researchers who found an exposed attacker-controlled server. This post treats the 2023 advisory as establishing history and severity, and the August 2026 reporting plus the CISA catalog addition as the evidence that this is a live, current threat.

Introduction

CVE-2023-49105 is an authentication bypass in ownCloud's file-sharing server, patched nearly three years ago, in late 2023. It should have been a closed chapter. Instead, in August 2026, independent security reporting tied it directly to the theft of nuclear research data from a Philippine government institute, and CISA responded by adding it to its Known Exploited Vulnerabilities catalog the very next day. A three-year-old bug in a file-sync platform just contributed to what is being described as a national-security-relevant data theft incident. Why hasn't a patched, well-documented authentication bypass died out yet, and why did it take a breach at a nuclear research body to bring it back into focus? That is what this post examines.

Original Disclosure Context

ownCloud disclosed CVE-2023-49105 on November 21, 2023, through its own security advisory, describing an authentication bypass in the WebDAV API's handling of pre-signed URLs. The flaw affects ownCloud Server core versions 10.6.0 up to, but not including, 10.13.1, and was fixed in version 10.13.1. ownCloud rated it CVSS 9.8, critical severity, and it was disclosed alongside two related ownCloud vulnerabilities in the same November 2023 advisory batch, one of which carried a maximum CVSS score of 10.0 for Docker-based deployments specifically. That higher-scoring, Docker-specific flaw received the bulk of initial press attention at the time, while CVE-2023-49105, which affected all ownCloud installations regardless of deployment method, received comparatively less immediate coverage despite arguably wider applicability.

Why This Vulnerability Persists

Several concrete factors explain why a nearly three-year-old, patched vulnerability contributed to a serious 2026 breach.

Exploitation depends on an easily overlooked configuration gap. The flaw is only exploitable when a target user account has no signing-key configured, a setting that is not mandatory and that many administrators are unlikely to know they need to set. An attacker only needs to know a valid username, and predictable corporate username formats make that trivial to satisfy in practice. This is a textbook case of low-complexity, unauthenticated exploitation with essentially no barrier to weaponizing at scale.

Mature public exploit tooling exists. A public proof-of-concept script that constructs a local proxy to sign WebDAV requests with an empty signing key has circulated since shortly after disclosure, and at least one automated vulnerability-scanning template capable of detecting the flaw is also publicly available, meaning no original research is required to weaponize it today.

It affects infrastructure that gets patched slowly by nature. File-sync and collaboration platforms like ownCloud are frequently deployed by research institutions, government bodies, and universities as long-lived, install-once systems, maintained outside the core IT security team's regular patch cadence. The confirmed 2026 incident against a nuclear research body is a direct illustration of exactly this pattern: a specialized government research organization running an internet-facing file server that had not been meaningfully reviewed since its original deployment.

Low visibility of the specific configuration flaw. Because the vulnerability depends on the absence of a setting rather than the presence of an obviously broken one, an administrator who patched ownCloud to a version released after the fix, but who set up their signing-key configuration incorrectly or not at all on an older, still-unpatched instance, may have no clear signal that they remain exposed. The vulnerability produces no unusual error messages or obvious warning signs during normal operation.

Chains effectively alongside other old, unpatched flaws. The same August 2026 campaign that exploited this ownCloud flaw also compromised a separate organization using an entirely different, unrelated vulnerability in outdated WordPress plugin software, both flaws having been publicly known and patched for roughly two years or more before exploitation. This reflects a broader operator pattern of scanning for internet-facing systems still running any old, unpatched software, rather than a bespoke, single-target operation, which keeps a vulnerability like this one relevant even years after disclosure, since it is one of many old locks an opportunistic or targeted attacker can try.

Current Exploitation Activity

The specific, dated evidence of current exploitation is a confirmed intrusion reported in August 2026. Threat intelligence researchers discovered an exposed, misconfigured attacker-controlled server, reportedly located in Amsterdam, on August 13, 2026, left accessible with directory listing enabled. That server contained custom exploit scripts targeting this specific ownCloud vulnerability, operational logs, and data that had been exfiltrated from at least one victim organization. Researchers reported their findings to the affected country's national computer emergency response team before publishing publicly. CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on August 27, 2026, one day after the underlying research was made public, with a federal remediation deadline of August 30, 2026.

Threat Actor Attribution

Public reporting describes the operator behind this campaign as a suspected Chinese-speaking threat actor, based on language artifacts found in the tooling and logs recovered from the exposed staging server. No specific, named advanced persistent threat designation has been publicly attached to this activity as of this writing, and this post states that plainly rather than assigning a more specific attribution than the available reporting supports. The campaign is described as occurring amid a broader pattern of cyber espionage activity targeting government, defense, research, and infrastructure organizations in the Philippines, a pattern regional reporting has connected to ongoing geopolitical tension in the South China Sea, though that broader geopolitical framing should be treated as context rather than confirmed attribution for this specific intrusion.

Exploitation Technique and Attack Chain

The core technique has not changed since disclosure in 2023. An attacker who knows a valid username on a vulnerable ownCloud instance constructs a pre-signed WebDAV URL, setting the credential parameter to the target username and generating a signature using an empty signing key, since the vulnerable code accepts such a signature as valid when the target account has no signing-key configured. This grants the attacker the ability to read, modify, or delete any file belonging to that account without ever authenticating.

What is notable about the confirmed 2026 campaign is not a technical evolution of the exploit itself, since the recovered scripts closely matched the logic already described in public proof-of-concept code from 2023, but the post-exploitation tooling layered on top of it. Reporting on the exposed staging server describes the presence of a Sliver command-and-control framework, Metasploit, and the Mettle implant alongside the custom ownCloud exploit scripts, indicating that initial unauthenticated file access through this CVE was used as a stepping stone toward broader access and data collection, rather than as the sole objective. The intrusion also reportedly involved a separate compromise of a second organization through an entirely different, unrelated software vulnerability, suggesting the operator was scanning for and exploiting multiple old, unpatched flaws across different targets rather than relying on this single CVE alone.

Affected Versions and Patch Status

CVE-2023-49105 affects ownCloud Server core versions 10.6.0 up to, but not including, 10.13.1. It was fixed in version 10.13.1, released alongside the November 2023 advisory. No public, aggregated scan count of currently exposed, unpatched ownCloud instances was identified for this post, so a precise still-vulnerable population cannot be stated. However, the confirmed 2026 compromise of a government research institute running an unpatched instance nearly three years after the fix was released is itself concrete evidence that meaningful pockets of exposure persist, particularly among organizations that treat file-sync platforms as low-priority infrastructure. As of September 25, 2026, current EPSS data places this CVE at approximately 43 percent, around the 99th percentile of scored vulnerabilities. Because EPSS is updated regularly as threat data changes, this figure should be treated as a current snapshot rather than a fixed property of the vulnerability.

MITRE ATT&CK Mapping

CISA's Known Exploited Vulnerabilities catalog does not natively publish a per-CVE ATT&CK technique mapping, so the rows below reflect only techniques directly described in public reporting on the confirmed August 2026 campaign itself, not a general mapping of the vulnerability class. Tactics with no documented, campaign-specific technique are marked as unavailable rather than filled speculatively.

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application, via the unauthenticated WebDAV pre-signed URL bypass against the internet-facing ownCloud server	T1190
Execution	Not applicable. No campaign-specific execution technique was described in available reporting.
Persistence	Not applicable. No campaign-specific persistence technique was described in available reporting.
Privilege Escalation	Not applicable. This CVE grants direct file access rather than an escalation path, and no escalation technique was described in available reporting.
Defense Evasion	Not applicable. No campaign-specific defense evasion technique was described in available reporting.
Command and Control	Remote Access Software, reflecting the documented use of the Sliver framework and Metasploit-based tooling recovered from the operator's exposed staging server	T1219

Notable Recent Incidents

The clearest recent, dated incident is the August 2026 intrusion against a Philippine government nuclear research institute. Reporting describes the theft of research-reactor component data, fuel inventory records, radiation-safety documentation, incident records, staff personnel information, and stored credential material, including a password-manager database and a document containing a disk-encryption recovery key. The same operator infrastructure was separately linked to a compromise of a Philippine marine engineering and shipbuilding company connected to naval services, though that second intrusion reportedly used a different, unrelated vulnerability rather than this ownCloud flaw. Both compromises came to light only because the attacker's own staging server was left publicly accessible with directory listing enabled, an operational security failure on the attacker's part rather than proactive detection by the victim organizations.

Risk Context for Organizations

This vulnerability is most relevant today to organizations running long-lived, internet-facing ownCloud deployments that are not part of a regularly reviewed patch cycle, a description that fits research institutions, universities, government bodies, and similarly specialized organizations more often than it fits mainstream enterprise IT environments with mature vulnerability management programs. The confirmed 2026 incident demonstrates that this risk is not merely theoretical for such organizations, and that the sensitivity of the data such institutions hold, in that case nuclear research material, can make them disproportionately attractive targets despite modest security budgets or staffing relative to the value of what they protect. Any organization that has never explicitly verified whether every user account on its ownCloud instance has a signing-key configured, even on a patched version, should treat that verification as an open task rather than an assumption.

Detection and Mitigation Considerations

Organizations should confirm every ownCloud Server instance is running version 10.13.1 or later, checked directly against the running version rather than assumed. Where immediate patching is not possible, temporarily disabling pre-signed URL functionality removes the specific exploitation path this CVE depends on. Administrators should also explicitly verify that signing-keys are configured for all user accounts, since this configuration gap is the specific condition the vulnerability requires, and should not treat a version upgrade alone as sufficient without also confirming this setting. Network segmentation limiting which hosts can reach the ownCloud web interface reduces the pool of potential attackers who can attempt exploitation in the first place. Given the documented use of Sliver, Metasploit, and Mettle tooling in the confirmed 2026 campaign, endpoint and network monitoring should watch for indicators associated with those specific frameworks on any host that has run ownCloud, in addition to reviewing WebDAV access logs for pre-signed URL requests associated with accounts that have no configured signing-key.

Key Takeaways

• CVE-2023-49105 is a critical, CVSS 9.8 authentication bypass in ownCloud Server, patched in November 2023, but confirmed by CISA as actively exploited as of August 2026, nearly three years later.
• It persists because exploitation depends on an easily overlooked, non-mandatory configuration gap, because mature public exploit tooling requires no original research to use, and because file-sync platforms like ownCloud are frequently deployed as long-lived, low-visibility infrastructure outside regular patch cycles.
• A suspected Chinese-speaking operator, not attributed to a specific named group, used this flaw to steal nuclear research and personnel data from a Philippine government institute in August 2026, alongside a separate intrusion at a naval-linked contractor using an unrelated vulnerability.
• The exploitation technique itself has not changed since 2023; what changed was the operator's use of established post-exploitation frameworks, Sliver, Metasploit, and Mettle, once initial file access was gained.
• Organizations should verify ownCloud is running version 10.13.1 or later, explicitly confirm signing-keys are configured for all accounts, and treat internet-facing file-sync platforms as high-value targets rather than background utilities.

Conclusion

CVE-2023-49105 illustrates a pattern that is easy to underestimate: a vulnerability does not need to be recently disclosed, or tied to a newly developed exploitation technique, to remain dangerous. It needs only to remain present on systems that have not been fully patched, reviewed, or correctly configured years after a fix became available. Well-known, well-patched vulnerabilities like this one often persist not because the fix was unavailable, but because long-lived infrastructure, overlooked configuration gaps, and systems outside regular patch cycles were never fully addressed. CISA's 2026 confirmation is a reminder that "patched years ago" and "no longer exploitable in practice" are not the same claim.

Instantly Fix Risks with Saner Patch Management

Saner Patch Management is a continuous, automated, and integrated patch management solution that helps organizations rapidly remediate vulnerabilities actively exploited in the wild. It supports Windows, Linux, macOS, and more than 550 third-party applications, enabling timely deployment of security updates across enterprise environments.

The platform also provides safe patch testing environments, automated deployment workflows, compliance reporting, and patch rollback capabilities to minimize operational risk while ensuring critical vulnerabilities are addressed without delay.

Experience the fastest and most accurate patching software here.