CVE-2016-6851: An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5.

Security readout for executives and security teams

CVE-2016-6851 is a cross-site scripting flaw in Open-Xchange OX Guard guest reader before 2.4.2-rev5. An unauthenticated attacker could cause script code to run in a user’s browser context, potentially hijacking sessions or causing unwanted mail and data actions if the user already has an active session on the same domain. Exposure is limited to organizations running Open-Xchange OX Guard versions before 2.4.2-rev5 with the guest reader web application reachable by users or the internet. Treat this as a priority remediation for affected OX Guard deployments, especially internet-facing systems. The business risk is unauthorized user-context actions, including mail activity and data deletion, through browser session abuse. Mitigation focus: Identify any deployed Open-Xchange OX Guard instances.; Confirm whether versions are before 2.4.2-rev5.; Upgrade to 2.4.2-rev5 or later where vendor guidance supports it..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.