This vulnerability allows an attacker who can reach the Oracle Outside In Technology service over the network to bypass authentication controls and modify critical data without any privileged or interactive access. The defect resides in the Outside In Clean Content SDK component of the product, permitting the creation, deletion or modification of records that are normally protected. The impact is limited to integrity, but because the vulnerability changes the security scope, the effects can extend to other interfaces that rely on the same data store.

Oracle Outside In Technology version 8.5.8 of Oracle Fusion Middleware is affected. No other versions or products are listed as impacted. The product is accessed via HTTP over the network.

The CVSS score of 8.6 signals a high severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests current exploitation activity is unknown. Attackers would likely use a simple HTTP request to the vulnerable endpoint, with no user interaction or privileged credentials required. Success would allow them to change sensitive data and potentially influence other products that use the same data, resulting in widespread integrity loss.