CVE-2016-6858: Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC)...

Security readout for executives and security teams

CVE-2016-6858 is an authenticated cross-site scripting issue in SAP Hybris Management Console's Create Employee feature. A logged-in remote user could place script or HTML in the Name field, potentially affecting other HMC users who view that data. Exposure is most likely where SAP Hybris HMC is still deployed, reachable by authenticated users, and running one of the listed vulnerable pre-fix versions. Internet exposure is not stated in the sources. Treat this as a targeted administrative-portal risk rather than a broad unauthenticated internet threat. Prioritize remediation if legacy SAP Hybris HMC remains in use, especially where many users can create employees or where HMC is broadly reachable. Mitigation focus: Identify any SAP Hybris HMC deployments and their exact maintenance versions.; Upgrade affected branches to the fixed versions listed in the CVE source bundle.; Restrict HMC access to trusted administrative networks and users..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.