by Kastro
Paper/Archive/CVE-2026-84473

CVE-2026-84473

Kiteworks ownCloud — CVE-2026-84473

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.5.275 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

Affected

ProductAffectedFixed inSource
ownCloud10.16.3 – < 11.1.011.1.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/KOBUKOVUI/CVE-2026-84473