CVE-2016-6857: Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC)...

Security readout for executives and security teams

CVE-2016-6857 is an authenticated cross-site scripting issue in SAP Hybris Management Console. A logged-in user could place script or HTML into the Create Catalogue ID field. For executives, the concern is misuse of an internal commerce administration console, especially where HMC is broadly accessible or exposed beyond trusted administrators. Exposure is most likely in legacy SAP Hybris environments using HMC versions earlier than the listed fixed releases. Risk is lower where HMC is fully patched, restricted to trusted administrators, and not reachable from untrusted networks. Prioritize remediation if legacy Hybris HMC is still in use, exposed to many users, or reachable outside restricted admin networks. If patched and isolated, track as routine legacy-platform assurance. Mitigation focus: Upgrade SAP Hybris to the fixed release for the deployed branch.; Restrict HMC access to trusted administrative networks and users.; Review SAP or vendor guidance before applying compensating controls..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.