This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. An attacker can create, delete or modify critical data or read additional data beyond the attacker’s normal scope. The issue results in confidentiality and integrity impacts, as defined by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) and a Base Score of 8.2. The impact is amplified because the vulnerability can modify the effective access scope to affect other products.

Oracle Outside In Technology version 8.5.8 is the only affected product. No other versions or vendors are listed as impacted.

The CVSS score of 8.2 places the vulnerability in the high severity bracket. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The required attack lever is a network addressable HTTP interface, with low complexity and no authentication; the attack requires a human to interact with the system in order to enable the compromise, indicating a possible phishing or social‑engineering component. Because the vulnerability allows the attacker to change the scope of access, the resulting compromise could expose or alter data across multiple downstream applications tied to Outside In Technology.