- Engineer — Act: CVE-2023-49105 (CVSS 9.8) is CISA KEV-listed with a public GitHub PoC and confirmed active exploitation; patch ownCloud to a non-vulnerable version immediately and audit file-access logs for anomalous activity since the PoC has been public.
- SOC/IR — Act: A Chinese-speaking threat actor is actively weaponizing this flaw for targeted data theft — hunt for unusual ownCloud authentication events and large data transfers in your estate, and correlate against any published IOCs from this campaign.
- Leader — Plan: Confirm whether ownCloud is present in your environment and verify engineering has applied the patch; the CISA KEV listing and nation-state targeting of critical-infrastructure research bodies makes this worth a direct question to your team this week.
- Signals: CVE-2023-49105 — CISA KEV: listed, EPSS 0.41, public PoC on GitHub