An unauthenticated local attacker who already has logon access to the underlying infrastructure can compromise Oracle Outside In Technology. The flaw allows the attacker to take full control of the Outside In Core component, leading to a complete takeover of the installation and loss of confidentiality, integrity, and availability. The underlying weakness corresponds to improper access control (CWE-200) that permits a local attacker to escape a restricted context and gain broader system control.

The vulnerability affects Oracle Corporation’s Oracle Outside In Technology product of Oracle Fusion Middleware, version 8.5.8. The specific component impacted is Outside In Core. No other versions or products are listed as affected.

CVSS 3.1 base score of 7.8 indicates high severity. The local attack requirement (AV:L) combined with low attack complexity (AC:L) means that an attacker who can log onto the infrastructure where Oracle Outside In Technology runs can attempt the exploit. The EPSS score of 0.00159 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, the need for human interaction from a third party (UI:R) suggests that social engineering or compromised accounts could be used to trigger the attack. Because the potential for complete takeover and the high impact on confidentiality, integrity, and availability are significant, the risk remains high and warrants immediate remediation.