Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle Outside In Technology 8.5.8 enables an unauthenticated attacker with network access via HTTP to force the application to hang or crash repeatedly, resulting in a complete denial of service. The flaw allows malicious input to be processed in a way that destabilizes the running service, potentially affecting all system operations that depend on Outside In. The impact is confined to availability; confidentiality and integrity are not directly compromised.

Affected Systems

Oracle Corporation’s Outside In Technology component of Oracle Fusion Middleware, version 8.5.8.

Risk and Exploitability

The vulnerability carries a CVSS 3.1 score of 7.5, indicating a high severity that can impact system availability. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely over HTTP without authentication, making it easily reachable from any network location that can reach the affected host.

Generated by OpenCVE AI on October 23, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for Outside In Technology 8.5.8.
  • Restrict HTTP access to the Outside In service to trusted IP ranges only.
  • Configure automated monitoring and restart of the Outside In service to mitigate repeated crashes.

Generated by OpenCVE AI on October 23, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Denial‑of‑Service via HTTP in Oracle Outside In Technology 8.5.8

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Denial‑of‑Service via HTTP in Oracle Outside In Technology 8.5.8
Weaknesses CWE-416

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:44:29.206Z

Reserved: 2026-09-14T22:10:16.629Z

Link: CVE-2026-91349

cve-icon Vulnrichment

Updated: 2026-10-22T18:40:55.434Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:37.440

Modified: 2026-11-10T15:18:39.600

Link: CVE-2026-91349

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T05:30:03Z

Weaknesses