CVE-2026-84473: Security vulnerability

Published Nov 6, 2026

Updated

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

Event History

Sep 1, 2026

Exploit Published

via GitHub·08:42 AM

Nov 6, 2026

CVE Published

via MITRE·06:25 PM

Data Sourced

via MITRE·06:25 PM

DescriptionWeakness

Data Sourced

via NVD·07:17 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

ownCloud server 10.16.3 instances with the remote.php/webdav/ endpoint reachable by an unauthenticated remote attacker are exposed to unlimited online password-guessing attempts against WebDAV accounts.

What does an attacker need to exploit it?

The attacker does not need prior authentication. They need network access to the WebDAV endpoint and can repeatedly submit HTTP Basic Authentication requests while guessing account passwords.

Is public exploit code available?

Yes. The available data flags a proof of concept, and an exploit was published on 2026-09-01.

CVE-2026-84473: Security vulnerability

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is public exploit code available?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is public exploit code available?