Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Oracle Outside In Technology contains an easily exploitable flaw where an unauthenticated attacker with network access via HTTP can trigger a hang or crash, thereby completely denying service to legitimate users. The vulnerability lacks authentication or authorization checks before processing requests.

Affected Systems

The affected vendor is Oracle Corporation, specifically its Outside In Technology component of Oracle Fusion Middleware. The vulnerable version is 8.5.8 as noted by Oracle, and any deployment of this version could be impacted if left unpatched.

Risk and Exploitability

The CVSS v3.1 score of 7.5 indicates a high-severity availability impact. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the description labels it as "easily exploitable" and requires only network access over HTTP without authentication, suggesting a high likelihood of real-world exploitation.

Generated by OpenCVE AI on October 21, 2026 at 14:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade version 8.5.8 with the vendor‑issued fix for the Outside In component.
  • If an immediate patch is not available, restrict external HTTP traffic to the Outside In service using firewall or network segmentation to limit attack surface.
  • Enforce strict input validation and monitoring of HTTP requests to Outside In to detect and mitigate malformed or suspicious traffic that may lead to crashes.

Generated by OpenCVE AI on October 21, 2026 at 14:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:22.009Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87398

cve-icon Vulnrichment

Updated: 2026-10-21T13:50:18.787Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:18.223

Modified: 2026-11-04T14:27:21.360

Link: CVE-2026-87398

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:15:15Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption