A vulnerability in Oracle Outside In Technology enables an attacker who can reach the system over HTTP to gain unauthenticated access. The weakness allows the attacker to read or obtain any data that the component serves, potentially completing a full compromise of all data exposed by Outside In. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N demonstrates that the flaw requires only network access, no privileged credentials, and that it changes the scope of affected data, resulting in a Base Score of 8.6.

Oracle Outside In Technology within the Oracle Fusion Middleware suite is affected. The specific vulnerable version is 8.5.8, which lacks the necessary patch to prevent unauthenticated HTTP access. Users running this version are at risk if the service remains exposed to the public network.

The flaw’s CVSS score of 8.6 marks it as a high‑severity vulnerability, and while the EPSS score is not available it is considered easily exploitable by remote attackers according to the description. It is not listed in the CISA KEV catalog, but the scope change (S:C) indicates that compromise of the Outside In component can potentially lead to compromise of additional Oracle products. Attackers can exploit the flaw by making an HTTP request to the affected service, requiring no authentication or special privileges, and can then retrieve sensitive data.