---
id: CVE-2026-84473
title: CVE-2026-84473
summary: >-
  Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/
  in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker
  to perform unlimited online password guessing against WebDAV accounts via
  repeated…
severity: none
cwe:
  - CWE-307
  - CWE-288
vendor: Kiteworks
product: ownCloud
affected:
  - ownCloud >= 10.16.3 < 11.1.0
exploitAvailable: true
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:25:49.272Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-84473'
references:
  - url: 'https://github.com/KOBUKOVUI/CVE-2026-84473'
tags:
  - cve.org
  - exploit-available
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/KOBUKOVUI/CVE-2026-84473'
  checkedAt: '2026-11-08T19:37:32.442Z'
ingestedAt: '2026-11-06T19:01:36.635Z'
epss: 0.00339
epssPercentile: 0.27474
---

## Overview

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

## Affected

- `ownCloud >= 10.16.3 < 11.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.