Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Compromise
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle Outside In Technology version 8.5.8 permits an unauthenticated attacker who can reach the system over HTTP to compromise the application. The vulnerability is classed as an access‑control weakness (CWE‑284). Successful exploitation requires a human other than the attacker to interact with the system, but once achieved it can result in a full takeover of the application, exposing the confidentiality, integrity, and availability of all data and services it manages.

Affected Systems

The affected product is Oracle Outside In Technology, a component of Oracle Fusion Middleware, specifically the Outside In Core module, in version 8.5.8 released by Oracle Corporation.

Risk and Exploitability

The CVSS 3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability. The EPSS score is below 1 percent, suggesting that historical exploitation attempts are rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the target via HTTP without authentication, but the need for a third‑party human interaction lowers the practical likelihood of a successful attack while still posing a noticeable risk to exposed servers.

Generated by OpenCVE AI on October 28, 2026 at 19:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch for Outside In Technology 8.5.8 or upgrade to a newer, fixed version.
  • Restrict HTTP access to the application by using firewalls or VPNs so that only trusted IP ranges can reach it.
  • Disable or remove externally accessible API interfaces that are not required for business functions.
  • Implement logging and monitoring for anomalous HTTP requests to detect potential abuse.

Generated by OpenCVE AI on October 28, 2026 at 19:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Allows Takeover of Oracle Outside In Technology 8.5.8

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Outside In Technology Allowing Takeover
Weaknesses CWE-640

Wed, 28 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle Outside In Technology Allowing Takeover
Weaknesses CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T14:53:09.369Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87397

cve-icon Vulnrichment

Updated: 2026-10-28T14:52:46.841Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:18.103

Modified: 2026-11-04T14:27:36.067

Link: CVE-2026-87397

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T19:30:15Z

Weaknesses