CVE-2016-6846: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 be...

Security readout for executives and security teams

This CVE is an Open-Xchange web application XSS issue. Unpatched AppSuite, Office Web, and Documentconverter-API components may allow a remote attacker to inject script or HTML into user-facing pages. The bundle does not show active exploitation or a CVSS score, so urgency depends on whether affected OX services remain deployed. Exposure is most likely where Open-Xchange AppSuite or Office Web from the listed pre-fixed revisions is still reachable by users or the internet. Legacy hosted webmail, collaboration portals, and document conversion services are the main environments to check. Prioritize confirmation if the organization still runs legacy Open-Xchange services. This is not shown as actively exploited, but unpatched XSS in webmail or collaboration platforms can affect user trust, session security, and data exposure. Mitigation focus: Upgrade affected OX components to the fixed revisions or later.; Review the Open-Xchange release notes for component-specific package guidance.; Prioritize internet-facing or externally accessible OX deployments..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.