ownCloud Left the Door Open: Three Active Exploits UK Small Businesses Need to Know About Now
Three vulnerabilities confirmed actively exploited in the last 48 hours. One of them requires no authentication whatsoever.
That is not a vendor’s threat report inflating the numbers. That is CISA’s Known Exploited Vulnerabilities catalogue, which exists for one purpose: to document flaws that are being used in live attacks right now.
Pull up a chair. Let’s go through what actually matters.
The Highest-Priority Item: ownCloud’s Authentication Bypass
CVE-2023-49105 was added to CISA’s KEV catalogue on 27 August 2026. The vulnerability is in ownCloud, a widely used open-source file sharing and collaboration platform.
Here is what it does: an attacker who knows a target’s username can access, modify, or delete any file on the system without providing a password. No credential required. The only precondition is knowing the account name, which in most organisations is either publicly visible or trivially guessable.
The mitigation condition that makes this worse: the victim must have no signing-key configured. In many default deployments, that condition is met.
ownCloud is used directly by many UK small businesses as a self-hosted alternative to Dropbox or SharePoint. It is also embedded in the infrastructure of managed service providers and hosting companies. If you do not use it yourself, your supplier might.
The patch for this vulnerability has been available. CISA’s confirmation of active exploitation means organisations that have not applied it are operating with an open door. The intelligence here is not complicated: this flaw is being weaponised in real campaigns. The decision about whether to check your patch status is yours.
The Linux Kernel Escalation: Broader Than It Looks
The second KEV addition from 27 August is CVE-2026-53362: a privilege escalation vulnerability in the Linux kernel, exploitable via the IPv6 networking subsystem.
Privilege escalation means an attacker who has already obtained limited access to a system can use this flaw to gain full administrative control. It turns a foothold into a takeover.
The affected scope is significant: SUSE, Red Hat, and any other product built on the Linux kernel. That includes the majority of cloud infrastructure, most on-premise servers running anything other than Windows, and a substantial proportion of network appliances.
For UK small businesses, the direct exposure is often indirect: your cloud hosting provider, your VPS, your NAS device, your MSP’s management platform. The question is not just “do we run Linux?” It is “does anything we depend on run Linux?” The answer is almost certainly yes.
The required action per CISA: apply vendor mitigations and follow BOD 26-04 patching guidance. In practice: contact your hosting provider or MSP, ask whether this has been addressed, and get confirmation in writing.
The Encryption Library Flaw That Defeats Verification
Also published in the last 24 hours: two critical vulnerabilities in openssl_encrypt (CVSS 9.8 each), assigned CVE-2026-81702 and CVE-2026-81707.
These are worth understanding clearly, because they attack something specific: the trust mechanism that tells you a file or message actually came from who you think it did.
CVE-2026-81702 allows an attacker to substitute their own public key into an identity store while keeping the original fingerprint displayed. In plain terms: the software shows you a trusted identity, but the encryption is actually happening with the attacker’s key. You believe you are communicating securely with a known contact. You are not.
CVE-2026-81707 allows an attacker to manipulate what appears on screen during fingerprint verification by injecting display sequences into the email field of an imported identity. The fingerprint verification process, which exists specifically to catch this kind of substitution, can be made to show a fraudulent result.
Versions before openssl_encrypt 1.4.9 are affected. If your organisation uses any software that relies on this library for encrypted communications or identity verification, version checking is appropriate.
These are not mass-exploitation vulnerabilities in the same immediate sense as the ownCloud flaw. They are the kind of precise, targeted attack that appears in supply chain compromises and business email fraud at the more sophisticated end. Relevant context: this week also saw reporting on AI agents autonomously exploiting zero-days. The intersection of automated exploitation capability with identity-spoofing vulnerabilities is not a comfortable one.
What This Looks Like From an SMB Perspective
The ownCloud vulnerability is the clearest immediate threat for most small businesses. Here is the exposure map:
Direct exposure: You run ownCloud as your file sharing platform. Any unpatched instance with internet-facing access is a candidate for exploitation.
Indirect exposure via your MSP: Your managed service provider uses ownCloud internally or as part of their client management stack. A compromise of your MSP’s ownCloud instance can expose client data and access credentials.
Indirect exposure via supply chain: A supplier or partner you share documents with uses ownCloud. Their breach can become your breach through shared files, credentials reused across systems, or lateral movement.
This is the supply chain risk pattern that NCSC guidance on supply chain security has consistently flagged as underaddressed by small businesses. The patch being available does not help if the vulnerable system is two layers removed from your direct oversight.
Why Patch Backlogs Persist and Why That Explanation Is Not Acceptable
The uncomfortable data point here is that CVE-2023-49105 has been known as a vulnerability since 2023. It has now appeared in CISA’s KEV catalogue in 2026, which means attackers have had years to develop reliable exploitation capability and are now actively deploying it.
Patch backlogs exist for identifiable reasons: resource constraints, fear of breaking production systems, lack of visibility into what software is actually running. These are real operational challenges. They are not a justification for leaving a known, actively exploited authentication bypass unaddressed.
The cost of applying a patch is measurable and usually modest. The cost of an unauthenticated attacker having full read/write/delete access to your file store is not modest. It includes GDPR breach notification obligations to the ICO, potential fines, the operational disruption of a data incident, and the reputational damage of telling clients their files were accessible.
The ICO’s guidance on technical security measures is unambiguous: organisations are expected to keep software up to date as a baseline security measure. Running unpatched software with a known, actively exploited CVE is a difficult position to defend to a regulator.
How This Gives Your Business an Edge
Being current on patching is increasingly a procurement differentiator. Larger organisations that have been burnt by supply chain incidents are asking harder questions of their smaller suppliers and partners.
If you can demonstrate a documented patching process, evidence of monitoring against known exploited vulnerability lists, and a clear line of accountability to your MSP for their infrastructure, you are materially ahead of competitors who cannot.
Cyber Essentials certification requires that software is patched within 14 days for high-severity vulnerabilities. CVE-2023-49105 and CVE-2026-53362 both qualify. Organisations holding Cyber Essentials that have not addressed these should be aware of the compliance position they are in.
The ability to tell a prospective client “we monitor CISA’s KEV catalogue and our MSP contractually commits to patch timelines” is a specific, verifiable claim. Very few SMBs can make it. That gap is your advantage.
Making the Business Case
Three arguments for your next conversation with whoever controls the budget:
The exploits are confirmed, not theoretical. CISA’s KEV catalogue does not include speculative risks. Every entry represents a vulnerability being used in real attacks. CVE-2023-49105 is on that list as of this week. That is a different conversation from “there’s a potential vulnerability.”
The regulatory exposure is concrete. An unauthenticated attacker accessing your file store triggers personal data breach obligations under UK GDPR if any personal data was held there. The ICO expects organisations to have taken reasonable technical measures. Unpatched software with a known active exploit does not meet that standard.
The MSP accountability conversation costs nothing. Asking your IT provider or MSP for written confirmation that CVE-2023-49105 and CVE-2026-53362 have been addressed in your environment, and in theirs, costs you an email. The alternative is discovering the answer the harder way.
What to Do Before Friday
-
Audit ownCloud usage. Ask your IT provider directly: is ownCloud running anywhere in our environment or yours? Get a written answer. If yes, confirm patch status against the vendor’s advisory for CVE-2023-49105.
-
Check Linux infrastructure currency. Any Linux-based server, cloud instance, or hosted service should be verified against CVE-2026-53362. Contact your hosting provider or MSP and request confirmation of patch status. This applies to managed WordPress hosting, VPS environments, and cloud-hosted business applications.
-
Verify openssl_encrypt versions. If your organisation uses any software for encrypted communications or digital identity verification, ask your IT provider whether openssl_encrypt is involved and whether it has been updated to 1.4.9 or later.
-
Request patch records in writing. Do not accept verbal assurances. Ask for a written confirmation that includes the CVE numbers addressed and the date patching was completed. This creates a documented record relevant to any future regulatory enquiry.
-
Check your Cyber Essentials status. If you hold the certification, high-severity CVEs with confirmed active exploitation should be patched within 14 days under the scheme’s requirements. Flag these items to whoever manages your certification.
Before you go: if this episode was useful, follow the show wherever you listen, leave a rating or a review, drop a comment with your thoughts, and share it with someone who should be having this conversation with their IT provider. It takes thirty seconds and it genuinely helps.