ownCloud CVE-2023-49105 Exploited by Chinese Actor to Steal Nuclear Data

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Act: CVE-2023-49105 (CVSS 9.8) is CISA KEV-listed with a public GitHub PoC and confirmed active exploitation; patch ownCloud to a non-vulnerable version immediately and audit file-access logs for anomalous activity since the PoC has been public.
SOC/IR — Act: A Chinese-speaking threat actor is actively weaponizing this flaw for targeted data theft — hunt for unusual ownCloud authentication events and large data transfers in your estate, and correlate against any published IOCs from this campaign.
Leader — Plan: Confirm whether ownCloud is present in your environment and verify engineering has applied the patch; the CISA KEV listing and nation-state targeting of critical-infrastructure research bodies makes this worth a direct question to your team this week.
Signals: CVE-2023-49105 — CISA KEV: listed, EPSS 0.41, public PoC on GitHub

Cve-2023-49105 on CuraSec