A vulnerability exists in Oracle Outside In Technology 8.5.8 that allows an unauthenticated attacker with network reachability over HTTP to gain unauthorized access to the application. The flaw can be exploited to read or modify critical data accessible through the application, or to achieve full control of all data exposed by the service. Exploitation may also cause a partial denial of service, interrupting the availability of the application for legitimate users. The weakness is identified as an improper access control issue, leading to confidentiality loss and limited availability impact as embodied in the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L.

Oracle Corporation’s Outside In Technology component of Oracle Fusion Middleware, specifically version 8.5.8, is affected. This version has no known mitigations other than applying the vendor’s patch, and the product is exposed to the public Internet via HTTP.

The CVSS v3.1 score of 8.2 indicates a high severity level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the reported vector, the threat can be executed remotely with no authentication and minimal effort, making it easily exploitable by an attacker who can reach the service over the network. The risk to confidentiality, integrity, and availability is high, and the attacker can potentially impersonate legitimate users or disrupt the service.