CVE-2023-49105 went into the federal Known Exploited Vulnerabilities catalog on 27 August with a 30 August due date — and the exploitation record behind it comes from one vendor that found the operator’s own staging server open to the internet.
What happened
On 27 August 2026, CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog. NVD’s republication of the entry — NIST carrying CISA’s fields verbatim — gives the vulnerability name as “ownCloud Improper Authentication Vulnerability,” a cisaExploitAdd of 2026-08-27 and a cisaActionDue of 2026-08-30. That is a three-day clock, and it expires on a Sunday.
The required action, quoted in full:
“Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.”
Under BOD 26-04, some three-day deadlines carry an obligation beyond the fix. The directive’s own language is that the “& forensic triage” marking “means that the agency must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.” Whether this asset falls in that band cannot be determined from the catalog entry — see the correction immediately below.
Correction, 28 August 2026, 4:03 p.m. Central. As first published, this story treated the entry’s citation of CISA’s “Forensics Triage Requirements” as an indication that CVE-2023-49105 sits in the three-day-plus-forensic-triage band. That inference is not supported. The same required-action string appears word for word on entries CISA added in the same 26–27 August window that carry 14-day due dates — CVE-2021-23758 and CVE-2022-0995, both due 9 September — as on the three-day entries. The citation is boilerplate and does not disclose the band. The 30 August due date is unaffected. We have written this up separately.
The flaw is almost three years old. NVD shows CVE-2023-49105 published 21 November 2023, CVSS v3.1 base score 9.8 assigned by NVD itself, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The description: “An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured … The earliest affected version is 10.6.0.”
Mechanically, it is a signature check that validates against nothing. ownCloud’s WebDAV API accepts pre-signed URLs carrying OC-Credential, OC-Date, OC-Expires, OC-Verb and OC-Signature parameters, with the signature derived from the file owner’s signing-key. When no signing-key exists — the default on a new install — the routine still ran using an empty secret, so anyone who knows a username can compute a signature that verifies. There is no credential to steal and no session to hijack. The username is the whole precondition.
ownCloud’s own advisory, “WebDAV Api Authentication Bypass using Pre-Signed Urls,” was published 21 November 2023 and last updated 29 November 2023. It gives the affected range as core 10.6.0 through 10.13.0, CVSS v3 9.8, and CWE-665, Improper Initialization. Its statement of the fix is a description of a code change — “Deny the use of pre-signed urls if no signing-key is configured for the owner of the files” — and it names no fixed version number.
The exploitation evidence is not in the catalog entry, but NVD’s reference list for the CVE now includes it. On 26 August 2026, the threat intelligence firm Hunt.io published an analysis built on an open directory it found at 31.58.209[.]241:8000 — 1,310 files, roughly 1.17 GB, left readable on the operator’s own staging host. Among them were five custom Python scripts implementing CVE-2023-49105 and a Go exploit for CVE-2024-28000, a LiteSpeed Cache privilege-escalation flaw in WordPress. The staged loot Hunt.io describes includes 176 files, about 372 MB, taken from a Philippine nuclear research agency; a 195 MB WordPress archive from a Philippine marine engineering and shipbuilding firm supplying naval services; and a 192 MB ZKTeco BioTime database dump.
On attribution, Hunt.io is careful and so are we: the report says the operator is “likely a Chinese speaker,” reasoning from simplified Chinese in code comments, docstrings, log output and folder names, and assesses “with medium confidence that this activity aligns with targeted collection.” It names no threat actor or group, and neither does CISA’s entry. Language in source code indicates the language of whoever wrote it; it does not establish sponsorship, nationality, or command.
Why it matters
This vulnerability spent almost three years being the one nobody bothered with. In December 2023, GreyNoise Labs published a piece titled “The Forgotten ownCloud vulnerability” and reported plainly: “We have not seen any exploitation attempts so far, but are watching for them!” That was two weeks after disclosure, when an unauthenticated file-access bug in a self-hosted file server should have been at peak attractiveness. It stayed ignored long enough that most inventories stopped tracking it.
What ended the quiet is not an exploitation wave picked up by sensors. It is one operator’s failure to close a directory — a different kind of evidence than the honeypot inference and vendor telemetry that usually drives a KEV addition, and worth being precise about. It is stronger in one respect: an analyst is reading the attacker’s own tooling and the files they took, with hashes and infrastructure published, rather than inferring intent from scan traffic. It is weaker in another: this is one vendor’s snapshot of one operator’s server. It establishes that CVE-2023-49105 is being used in targeted collection against a small number of victims. It does not establish exploitation at scale.
A second asymmetry is easy to miss. The same directory held a working exploit for CVE-2024-28000 and a complete site archive taken with it. As of this check, NVD’s record for CVE-2024-28000 carries no cisaExploitAdd, cisaActionDue or cisaVulnerabilityName field at all — it is not in the catalog. One campaign, two documented exploits, one KEV addition. Anyone treating the catalog as a complete map of what is being exploited should sit with that: the same report that got one flaw listed left the other where it was.
Then there is the calendar. CVE-2023-49105 is due Sunday 30 August, and it is not alone: the Citrix NetScaler flaw CVE-2026-8452 carries a cisaActionDue of 29 August, and a seven-year-old Microsoft SQL Server remote code execution bug added on 26 August is due the same Saturday. Three federal deadlines inside one weekend. Short clocks are the current normal under BOD 26-04 and are not anomalous. But the directive derives deadlines from technical variables — internet exposure, KEV listing, exploit automation, and whether technical impact is total or partial — and the day of the week is not one of them. Which day a deadline lands on is an artifact of when CISA adds the entry.
Underneath the clock sits a records problem. The entry tells agencies to “apply mitigations in accordance with vendor instructions,” and the vendor’s instruction, unrevised since November 2023, describes what the patch does rather than naming the release that contains it. For a three-day deadline that also demands a documented forensic assessment, “deny the use of pre-signed urls if no signing-key is configured” is not a remediation target you can hand to a change-control board.
What to do
Find them first, then upgrade. The affected product is ownCloud Server Classic core, versions 10.6.0 through 10.13.0 inclusive. Self-hosted installations tend to live outside the inventories that track SaaS and endpoint agents — departmental file shares, research group servers, instances stood up years ago by someone who has since left. ownCloud’s documentation lists Classic 11.0 as the current stable release and 10.16 as the previous stable; anything in the affected window is outside both.
If you cannot upgrade before the deadline, set a signing-key. The bug only fires when the file owner has no signing-key configured, which is the default. Configuring one for every user closes the specific bypass. Treat it as a stopgap, and confirm coverage account by account.
Look for the request shape. Search WebDAV access logs for requests carrying OC-Credential, OC-Signature, OC-Expires and OC-Verb parameters, particularly for accounts that never had reason to generate a pre-signed URL. The attack needs no credential and creates no session, so authentication logs will not show it. The request is the only trace.
Check the published infrastructure. Hunt.io names 31.58.209[.]241 as the host of the open directory and publishes file hashes, further IPs and domains — indicators for one operator, not a detection strategy, but free to check.
FCEB agencies: establish the band, do not read it off the entry. The required action cites CISA’s Forensics Triage Requirements, but that text is identical on entries carrying 14-day deadlines, so it does not tell you whether this asset also owes a forensic triage. Determine that from BOD 26-04 and from CISA directly. [Corrected 28 August 2026 — see the note above.]
Sourcing note
KEV dates, the vulnerability name and the required-action text come from NVD’s API record for CVE-2023-49105, which republishes CISA’s catalog fields verbatim. cisa.gov blocks automated fetching and returned 403 to a direct request for the 27 August alert page, so the catalog page was not read; CVE-2024-28000’s KEV status was checked the same way, through its NVD record, which carries no CISA fields. CISA’s 27 August alert is titled “CISA Adds Three Known Exploited Vulnerabilities to Catalog”; at the time of this check NVD reflected one of the three. Secondary coverage identifies the other two as the Linux kernel and JFrog issues covered separately here this morning — not primary-sourced, and not verified.
Mechanics, affected versions and the statement of the fix come from ownCloud’s advisory of 21 November 2023, last updated 29 November 2023; release status from ownCloud’s documentation site. The missing fixed version is the advisory’s own state, not an omission here.
The comparison of required-action strings across the 26–27 August additions was made from NVD API records for CVE-2023-49105, CVE-2019-1068, CVE-2026-8452, CVE-2021-23758 and CVE-2022-0995. All five carry the same required-action text across two different deadline bands.
Exploitation evidence is single-source: Hunt.io’s report of 26 August 2026. The file counts, byte totals, victim descriptions, IP address and attribution language are that firm’s, reported here as its findings. No second vendor has published corroborating telemetry, no named victim has confirmed an intrusion, and CISA’s entry does not cite its evidence. The GreyNoise observation is from 5 December 2023 and describes conditions at that time only. Unresolved: whether exploitation extends beyond the victims Hunt.io names, and which ownCloud release first contained the fix.