A vulnerability in Oracle Outside In Technology’s Outside In Clean Content SDK allows an attacker with network access over HTTP to gain unauthorized access to critical data and, in some cases, to modify that data via insert, update, or delete operations. The weakness is caused by improper input validation, missing access controls, and the exploitation of missing user role checks, as indicated by the CWE-20 identifier. The CVSS score of 8.2 highlights a high severity, with significant confidentiality impact and a lower integrity impact, while the availability of the system is not affected.

Oracle Corporation’s Outside In Technology product, version 8.5.8, which is part of Oracle Fusion Middleware. The impact may extend to additional Oracle products that share the same environment or use the same database, because the vulnerability allows broad access to all data exposed through the Outside In interface.

The CVSS score of 8.2 indicates a high severity. Though the EPSS score of less than 1% suggests a low probability of exploitation in the wild, the combination of a network‑level attack vector (AV:N), low attack complexity (AC:L), user interaction required (UI:R), and scope change (S:C) means that an attacker who succeeds in social engineering a user can truly gain unauthorized access and potentially modify data. The vulnerability is not listed in the CISA KEV catalog, but its potential for extensive data exposure and modification still represents a high priority for remediation.