Chinese Actor Exploits ownCloud Flaw, Steals Philippine Nuclear Records

The U.S. Cybersecurity and Infrastructure Security Agency added a critical ownCloud vulnerability to its Known Exploited Vulnerabilities catalog Thursday following a confirmed breach at a Philippine nuclear research institution.

The flaw, tracked as CVE-2023-49105 with a CVSS score of 9.8, was exploited by a Chinese-speaking threat actor to access and exfiltrate nuclear research records. The vulnerability's addition to the KEV catalog signals active exploitation in the wild and mandates remediation by federal agencies within prescribed timelines.

ownCloud, an open-source file-sharing and collaboration platform, is deployed across research institutions, enterprises, and government agencies globally. The severity rating reflects the ease of exploitation and the potential for unauthorized access to sensitive data stores. CISA's catalog inclusion typically follows confirmed incidents where adversaries have successfully weaponized a vulnerability against operational targets.

• 01Federal agencies must patch ownCloud instances per CISA binding operational directive timelines.
• 02Research institutions and defense contractors face elevated risk from targeted exploitation campaigns.
• 03Nuclear sector entities should audit file-sharing platforms for unauthorized access indicators.
• 04Organizations in Indo-Pacific region should review exposure to Chinese-attributed threat actors.