A local vulnerability in Oracle Outside In Technology allows an attacker who is not authenticated but has access to the same infrastructure to compromise the application. The attacker needs to rely on a secondary user to provide the necessary human interaction to trigger the exploit. Once successful, the attacker can take full control of the service, exposing all data and disrupting business operations by compromising confidentiality, integrity, and availability.

Oracle Outside In Technology 8.5.8 – part of Oracle Fusion Middleware, component Outside In Core – is affected. All installations running the specified version are vulnerable; no other versions are listed.

The CVSS 7.8 score marks this as a high‑severity flaw. EPSS is not available and the issue is not listed in CISA KEV. The local attack vector and requirement for human interaction lower the chances of spontaneous remote exploitation but still pose significant risk when users with local access are in place. Proper network segmentation, restrictive local access permissions, and user awareness can mitigate potential attacks but a vendor patch is recommended to close the vulnerability.