On August 27, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation:
- CVE-2023-49105 — ownCloud Improper Authentication Vulnerability
- CVE-2026-53362 — Linux Kernel Unspecified Vulnerability
- CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory (path traversal)
A KEV listing is not a theoretical exercise — it means threat actors are exploiting these flaws in the wild, right now. Two of the three affect internet-facing enterprise services (file collaboration and artifact repositories), which are perennially high-value targets for initial access, credential theft, and software supply-chain compromise. The third affects the Linux kernel, meaning exploitation translates directly to privilege escalation or full host compromise on servers and appliances.
Note on the ownCloud entry: although CVE-2023-49105 was originally disclosed in 2023, its inclusion in the KEV this week signals renewed, ongoing exploitation against unpatched instances. If your organization is still running a vulnerable ownCloud deployment three years later, attackers are actively hunting you. The present-day campaign is the story — not the age of the bug.
Under Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities within prescribed timelines. Even outside the federal enterprise, treat KEV additions as your de facto patch priority list — exploitation is confirmed, not hypothetical.
Technical Analysis
CVE-2023-49105 — ownCloud Improper Authentication
Affected product: ownCloud core deployments running the vulnerable graphapi app (vulnerable versions predate the fixed graphapi release; any instance that has not applied the November 2023 security update remains exposed).
The flaw stems from improper authentication in the ownCloud graphapi application, which ships a third-party dependency containing a GetPhpInfo.php test script reachable over HTTP without authentication. An unauthenticated remote attacker can directly request the script and obtain the full phpinfo() output from the server. That output discloses sensitive server configuration data — and critically, in containerized deployments where credentials are passed as environment variables (the documented Docker pattern for ownCloud), it exposes administrative credentials, database passwords, and object storage keys.
Why it matters to defenders: This is a CVSS 10.0-class issue: no authentication, no user interaction, remotely exploitable, and the harvested credentials enable full administrative takeover of the ownCloud instance and lateral movement into any system reusing those secrets. Its KEV addition in 2026 confirms attackers are still scanning for and exploiting stale instances.
Exploitation requirements: Network reachability to the ownCloud web tier (typically TCP 80/443). No credentials needed.
CVE-2026-53362 — Linux Kernel Unspecified Vulnerability
Affected product: Linux kernel builds as distributed by major vendors. CISA's advisory carries no component-level detail in the public summary; operators should consult their distribution's security tracker (Red Hat, Canonical/Ubuntu, SUSE, Debian) for the specific CVE mapping and patched kernel packages.
Actively exploited Linux kernel vulnerabilities in KEV almost universally represent privilege escalation primitives — an attacker who has gained low-privileged code execution (via a web shell, a compromised service account, or a phished user) weaponizes the kernel flaw to obtain root. This is the classic second-stage move in ransomware and intrusion chains.
Defensive posture: Treat every internet-facing and multi-user Linux system as in-scope until your vendor confirms otherwise. Kernel updates require reboots — schedule them; do not defer them past the BOD 26-04 window.
CVE-2026-66384 — JFrog Artifactory Path Traversal
Affected product: JFrog Artifactory (self-hosted deployments). The flaw is an improper limitation of a pathname to a restricted directory — a classic CWE-22 path traversal in an Artifactory web/API endpoint.
Path traversal in an artifact repository is especially dangerous. Artifactory sits at the heart of the software supply chain: it stores build artifacts, Docker images, libraries, and often cached credentials/tokens for upstream registries. Depending on the endpoint affected, exploitation could allow an attacker to read arbitrary files outside the intended directory (configuration files, private keys, stored credentials) or — in write-capable traversal variants — overwrite artifacts and plant malicious packages that downstream CI/CD pipelines will happily pull and execute.
Exploitation requirements: HTTP access to the Artifactory web interface/API. Depending on the endpoint, exploitation may be unauthenticated or require a low-privileged account; assume the former until JFrog's advisory confirms otherwise.
Exploitation status for all three: Confirmed active exploitation per CISA KEV. These are not proof-of-concept-only findings.
Detection & Response
The detections below target the highest-fidelity observable behaviors for each vulnerability. For the kernel CVE, public technical detail is insufficient to write a precise rule — apply vendor patches and monitor for generic privilege-escalation anomalies rather than deploying speculative detections that will generate noise.
Sigma Rules
---
title: ownCloud graphapi GetPhpInfo.php Unauthenticated Access
description: Detects HTTP requests to the GetPhpInfo.php test script shipped with the vulnerable ownCloud graphapi dependency. Successful access discloses phpinfo output including environment variables such as database and admin credentials in containerized deployments. Associated with active exploitation of CVE-2023-49105.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/27
status: experimental
logsource:
category: webserver
product: apache
service: access
detection:
selection:
cs-uri|contains:
- '/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php'
- '/apps/graphapi/vendor/microsoft/microsoft-graph/tests/getphpinfo.php'
condition: selection
falsepositives:
- None expected; this script has no legitimate runtime purpose in production.
level: critical
---
title: JFrog Artifactory Path Traversal Attempt in HTTP Request
description: Detects directory traversal sequences (raw and URL-encoded) in requests targeting JFrog Artifactory endpoints. Consistent with exploitation attempts against CVE-2026-66384, an actively exploited path traversal flaw.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/27
status: experimental
logsource:
category: webserver
product: nginx
detection:
selection_target:
cs-uri|contains:
- '/artifactory/'
- '/ui/api/'
selection_traversal:
cs-uri|contains:
- '/../'
- '..%2f'
- '%2e%2e%2f'
- '%2e%2e/'
- '..%252f'
- '%252e%252e'
condition: selection_target and selection_traversal
falsepositives:
- Rare; legitimate Artifactory clients do not send traversal sequences. URL-encoded dots in legitimate artifact names are possible — tune for your repository naming conventions.
level: high
---
title: Web Service Process Spawning Shell on Linux
description: Detects common Linux web server daemons (apache2, nginx, httpd, php-fpm, java for Artifactory/Tomcat) spawning interactive shells — a hallmark of post-exploitation web shell activity following compromise of an internet-facing service.
references:
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/27
status: experimental
logsource:
category: process_creation
product: linux
service: auditd
detection:
selection_parent:
ParentImage|endswith:
- '/apache2'
- '/nginx'
- '/httpd'
- '/php-fpm'
- '/java'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
condition: selection_parent and selection_child
falsepositives:
- Application deployment hooks and health-check scripts; Artifactory plugins and CI jobs invoking java subprocesses. Baseline per-host before alerting.
level: high
KQL — Microsoft Sentinel (Web Proxy / Firewall / Syslog ingestion)
// Hunt for ownCloud CVE-2023-49105 and Artifactory CVE-2026-66384 exploitation attempts
// Requires web proxy, WAF, or firewall logs ingested via CommonSecurityLog (CEF) or Syslog
let window = 14d;
union
(CommonSecurityLog
| where TimeGenerated > ago(window)
| extend Uri = coalesce(RequestURL, AdditionalExtensions)
| where Uri has_any ("GetPhpInfo.php", "%2e%2e", "..%2f", "/../", "%252e%252e")
| project TimeGenerated, SourceIP, DestinationHostName, Uri, RequestMethod, DeviceAction),
(Syslog
| where TimeGenerated > ago(window)
| where SyslogMessage has_any ("GetPhpInfo.php", "%2e%2e", "..%2f", "%252e%252e")
| project TimeGenerated, HostName, ProcessName, SyslogMessage)
| order by TimeGenerated desc
Velociraptor VQL — Linux Web Server Post-Exploitation Hunt
-- Hunt for shells and interpreters spawned by web service daemons on Linux hosts
-- Indicator of web shell deployment after exploitation of ownCloud or Artifactory
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
pslist(Pid=Ppid).Name AS ParentName,
pslist(Pid=Ppid).CommandLine AS ParentCommandLine
FROM pslist()
WHERE (ParentName =~ '^(apache2|nginx|httpd|php-fpm|java)$'
OR ParentCommandLine =~ 'artifactory|tomcat')
AND Name =~ '^(sh|bash|dash|zsh|python|python3|perl|nc|ncat|socat)$'
Verification & Triage Script
#!/bin/bash
# KEV triage: ownCloud CVE-2023-49105 + Artifactory CVE-2026-66384 + kernel exposure check
# Run on web/application hosts or against centralized log storage
echo "=== [1] ownCloud: check for vulnerable graphapi app ==="
if command -v occ >/dev/null 2>&1; then
sudo -u www-data php /var/www/owncloud/occ app:list 2>/dev/null | grep -i graphapi
fi
[ -d /var/www/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests ] && \
echo "[!] VULNERABLE: GetPhpInfo.php dependency tree present" && \
ls -la /var/www/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/
echo "=== [2] Scan web logs for exploitation attempts (last 30 days) ==="
grep -rEih 'GetPhpInfo\.php|%2e%2e|\.\.%2f|%252e%252e|/\.\./' \
/var/log/apache2/ /var/log/nginx/ 2>/dev/null | grep -iE 'graphapi|artifactory' | tail -50
echo "=== [3] Artifactory: confirm running version (compare against JFrog advisory) ==="
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8082/artifactory/api/system/version 2>/dev/null
curl -s http://localhost:8082/artifactory/api/system/version 2>/dev/null
echo "=== [4] Linux kernel exposure check (CVE-2026-53362) ==="
uname -r
echo "Compare against your distribution security tracker for patched kernel builds."
( command -v apt >/dev/null && apt list --upgradable 2>/dev/null | grep -i linux-image ) || \
( command -v dnf >/dev/null && dnf check-update kernel 2>/dev/null ) || \
( command -v yum >/dev/null && yum check-update kernel 2>/dev/null )
echo "=== [5] Post-exploitation check: web server child shells ==="
ps -eo pid,ppid,user,comm,args --forest | grep -E 'apache2|nginx|httpd|php-fpm|java' -A1 | grep -E 'bash|sh|python|perl|nc '
Remediation
1. ownCloud (CVE-2023-49105)
- Patch: Update the
graphapiapp to the fixed release (0.3.1 or later) via the ownCloud Marketplace, or apply the full November 2023 ownCloud security update. If the instance is unmanaged or end-of-life, decommission it — do not leave it internet-facing. - Immediate containment (if patching is delayed): Block external access to
/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.phpat the web server/WAF layer, or delete thetestsdirectory from the dependency tree. Disable the graphapi app entirely if unused. - Credential hygiene (mandatory): Because exploitation discloses environment variables, assume compromise of any instance that was internet-exposed while vulnerable: rotate the ownCloud admin password, database credentials, and any object-storage/API keys, and invalidate active sessions. Hunt access logs with the Sigma rule above before declaring the host clean.
- Reference: ownCloud security advisory and CISA KEV Catalog.
2. Linux Kernel (CVE-2026-53362)
- Patch: Apply your distribution's updated kernel packages immediately (Red Hat, Ubuntu, SUSE, Debian security trackers) and reboot. KEV-listed kernel flaws have no workaround — patching is the remediation.
- Inventory first: Identify all internet-facing and multi-tenant Linux systems (web servers, VPN concentrators, hypervisors, container hosts). Prioritize systems where an attacker could plausibly have obtained an initial low-privilege foothold — kernel bugs are typically privilege-escalation second stages.
- Cloud images: confirm your base AMIs/images pull updated kernels on rebuild; running instances still require explicit patching.
3. JFrog Artifactory (CVE-2026-66384)
- Patch: Upgrade self-hosted Artifactory to the fixed version per JFrog's security advisory (check the JFrog security advisories page at jfrog.com for the CVE-2026-66384 fixed build and release notes). SaaS customers receive the fix automatically.
- Interim hardening (if patching is delayed):
- Restrict network access to the Artifactory UI/API (TCP 8081/8082) to trusted CI/CD networks and administrative jump hosts only — it should never be broadly internet-reachable.
- Deploy a WAF/reverse-proxy rule blocking requests containing raw or encoded traversal sequences (
../,%2e%2e,..%2f, double-encoded variants) against Artifactory endpoints. - Enforce authentication on all endpoints; audit and disable anonymous access if enabled.
- Post-patch validation: Audit artifact integrity — verify hashes of recently modified artifacts against known-good builds, review repository audit logs for unexpected uploads/overwrites, and rotate any credentials or tokens stored in Artifactory configuration if the instance was internet-exposed.
4. Federal Deadlines (BOD 26-04)
FCEB agencies must remediate all three vulnerabilities within the timelines established by BOD 26-04 as reflected in the KEV Catalog's due-date fields. Confirm the specific due dates at the KEV Catalog and report remediation status accordingly. Non-federal organizations should adopt the same deadlines as internal SLAs — KEV entries are the single most reliable prioritization signal available.
5. Strategic Takeaways
- Internet-facing collaboration and DevOps infrastructure is your highest-risk attack surface. ownCloud, Artifactory, and similar platforms store credentials, artifacts, and data — they warrant the same patching rigor as firewalls and VPNs.
- A 2023 CVE landing in KEV in 2026 is an indictment of asset management. If you cannot enumerate every ownCloud/Artifactory instance in your estate within an hour, fix that first — attack surface management pays for itself on exactly days like this.
- Assume breach on anything that sat vulnerable and exposed. Patch-and-forget is insufficient for KEV entries; pair every remediation with log-based compromise assessment using the detections above.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.