Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated attacker can send a specially crafted HTTP request to the Oracle Outside In Clean Content SDK component of Oracle Outside In Technology. The flaw causes the SDK to crash or hang when processing such requests, resulting in a complete denial of service.

Affected Systems

Oracle Outside In Technology version 8.5.8, part of Oracle Fusion Middleware, is affected. The vulnerability resides in the Outside In Clean Content SDK module, which is used for content processing and filtering.

Risk and Exploitability

The CVSS 3.1 Base Score of 7.5 highlights a high availability impact with no requirement for authentication. Attackers only need network access to the exposed HTTP interface, making exploitation straightforward. EPSS is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, but its high CVSS score indicates it is a serious threat when left unpatched.

Generated by OpenCVE AI on October 23, 2026 at 07:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch that updates Outside In Technology from 8.5.8 to a patched release, as issued in the Oracle Fusion Middleware Security Alert 2026‑10.
  • If patching cannot be performed immediately, block external HTTP traffic to the Outside In Clean Content SDK or disable the service so unauthenticated requests cannot reach it.
  • Configure network firewalls or access controls to restrict inbound connections to the SDK and monitor for abnormal request patterns or crash events.

Generated by OpenCVE AI on October 23, 2026 at 07:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Denial of Service in Oracle Outside In Technology

Fri, 23 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Request Causes Crash in Oracle Outside In Technology
Weaknesses CWE-20

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Request Causes Crash in Oracle Outside In Technology
Weaknesses CWE-20

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:21.523Z

Reserved: 2026-09-14T22:10:16.629Z

Link: CVE-2026-91344

cve-icon Vulnrichment

Updated: 2026-10-22T18:41:30.638Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:36.840

Modified: 2026-10-22T19:18:03.833

Link: CVE-2026-91344

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T07:45:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption