Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (complete crash via HTTP)
Action: Immediate Patch
AI Analysis

Impact

Easily exploitable, unauthenticated HTTP requests sent to Oracle Outside In Technology 8.5.8 cause the Outside In Core component to hang or crash repeatedly, leading to a complete denial of service. The CVE description does not specify the root cause, but the impact is availability only.

Affected Systems

The affected product is Oracle Outside In Technology version 8.5.8, part of Oracle Fusion Middleware, provided by Oracle Corporation.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates high severity with a high likelihood of successful exploitation via standard network access. Exploitation requires no authentication, low effort, and no special privileges; the attack vector is through HTTP, making it easily reachable by any networked attacker. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and unimpeded network access imply a significant risk for exposed instances.

Generated by OpenCVE AI on October 21, 2026 at 14:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or update for Oracle Outside In Technology 8.5.8 that addresses CVE‑2026‑87395.
  • If an update is not immediately available, restrict inbound HTTP traffic to the Outside In Technology service to trusted networks or firewall segments to reduce exposure.
  • Continuously monitor logs for abnormal crash patterns and implement automated restart procedures for the service until a confirmed fix is applied.

Generated by OpenCVE AI on October 21, 2026 at 14:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-based Denial of Service in Oracle Outside In Technology 8.5.8
Weaknesses CWE-400
CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:22.185Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87395

cve-icon Vulnrichment

Updated: 2026-10-22T18:41:58.405Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:17.860

Modified: 2026-11-04T14:28:03.993

Link: CVE-2026-87395

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:30:11Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling