Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Complete Crash)
Action: Patch Immediately
AI Analysis

Impact

A network‑accessible HTTP endpoint in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker to trigger a hang or frequent crash without any credentials. The vulnerability requires human interaction from a person other than the attacker, but once activated it results in a complete denial of service of the Outside In component.

Affected Systems

Oracle Outside In Technology, Oracle Fusion Middleware component Outside In Core, version 8.5.8.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 reflects high availability impact with no required privileges or scope escalation. Exploitation probability is not quantified in EPSS and the vulnerability is not listed in CISA KEV. Attack is likely over HTTP from a remote location and, while unauthenticated, still requires an external user to trigger the attack vector. If successful, the system will crash, denying service to legitimate users.

Generated by OpenCVE AI on October 21, 2026 at 07:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch that resolves CVE-2026-87393 or upgrade to a newer release that contains the fix.
  • Restrict HTTP access to the Outside In service using firewall rules or network segmentation so only trusted hosts can reach the vulnerable endpoint.
  • Monitor application logs for repeated crash attempts and enforce throttling or rate‑limiting to mitigate automated DoS attacks.

Generated by OpenCVE AI on October 21, 2026 at 07:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Denial of Service in Oracle Outside In Technology 8.5.8
Weaknesses CWE-284
CWE-734

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T14:49:54.493Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87393

cve-icon Vulnrichment

Updated: 2026-10-28T14:49:27.177Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:17.617

Modified: 2026-11-04T14:28:25.177

Link: CVE-2026-87393

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses