Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution and Full Compromise
Action: Patch Immediately
AI Analysis

Impact

The vulnerability resides in the Oracle Outside In Technology product of Oracle Fusion Middleware, specifically in the Outside In Clean Content SDK component. An attacker who only has low privileges but can reach the service over HTTP can exploit the flaw. Successful exploitation can lead to full takeover of the application, affecting confidentiality, integrity, and availability. The vulnerability is easy to exploit and is rated high severity with a CVSS 3.1 base score of 8.8.

Affected Systems

Oracle Corporation’s Outside In Technology product, version 8.5.8, is affected. No other versions are listed as impacted in the current CNA record.

Risk and Exploitability

This flaw carries a high CVSS score of 8.8 and, according to the EPSS score of <1%, has a very low probability of exploitation today. It is not listed in the CISA KEV catalog. The attack vector is remote over HTTP, requiring only low privileges from an external network. Successful exploitation can lead to remote code execution or full system compromise by taking over the application.

Generated by OpenCVE AI on October 28, 2026 at 23:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Outside In Technology patch or upgrade to a non‑affected version as soon as it becomes available.
  • If an immediate patch is not possible, restrict access to the Outside In Technology HTTP endpoint using firewall rules, network segmentation, or VPN only for trusted hosts.
  • Conduct a security assessment to verify there is no evidence of exploitation and monitor logs for anomalous activity related to the Outside In Technology component.

Generated by OpenCVE AI on October 28, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Oracle Outside In Technology 8.5.8 Remote Code Execution via HTTP

Wed, 28 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Low Privileged Network Attack Enables Full Compromise of Oracle Outside In Technology
Weaknesses CWE-269
CWE-285

Wed, 28 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low Privileged Network Attack Enables Full Compromise of Oracle Outside In Technology
Weaknesses CWE-269
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T18:01:38.540Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91340

cve-icon Vulnrichment

Updated: 2026-10-28T18:01:32.272Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-20T22:20:36.360

Modified: 2026-10-28T19:19:20.777

Link: CVE-2026-91340

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:45:14Z

Weaknesses