{"id":"CVE-2026-84473","aliases":["EUVD-2026-118402","GHSA-394x-x23m-q4f9"],"status":"published","title":"CVE-2026-84473","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-15","score":0.00522,"percentile":0.44903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-288","CWE-307"],"published":"2026-11-06T18:25:49Z","modified":"2026-11-10T18:24:26Z","exploits":[{"source":"pocgithub","id":"KOBUKOVUI/CVE-2026-84473","title":"KOBUKOVUI/CVE-2026-84473","date":"2026-09-01","url":"https://github.com/KOBUKOVUI/CVE-2026-84473"}],"products":[{"vendor":"kiteworks","product":"owncloud"}],"references":[{"url":"https://github.com/KOBUKOVUI/CVE-2026-84473"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84473"},{"url":"https://github.com/advisories/GHSA-394x-x23m-q4f9"}],"sources":{"cve":[{"id":"CVE-2026-84473","title":"CVE-2026-84473","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","status":"published","published":"2026-11-06T18:25:49.272Z","modified":"2026-11-10T18:24:26.976Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-307","CWE-288"],"updated_at":"2026-11-10T19:39:59.74912Z"}],"euvd":[{"id":"EUVD-2026-118402","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","status":"published","published":"2026-11-06T18:25:49Z","modified":"2026-11-10T18:24:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T19:22:07.113031Z"}],"ghsa":[{"id":"GHSA-394x-x23m-q4f9","title":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud...","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","status":"published","published":"2026-11-06T21:31:28Z","modified":"2026-11-10T21:31:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-10T21:57:47.623655Z"}],"nvd":[{"id":"CVE-2026-84473","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","status":"published","published":"2026-11-06T19:17:57.687Z","modified":"2026-11-12T20:04:52.377Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-288","CWE-307"],"updated_at":"2026-11-10T22:21:31.83577Z"}]}}