Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service
Action: Patch
AI Analysis

Impact

The Oracle Outside In Technology product contains a flaw in its Outside In Clean Content SDK that processes unauthenticated HTTP requests. An attacker with network access can send crafted requests to the exposed cleanup endpoint, resulting in a partial denial of service that interrupts the availability of the affected services. The vulnerability has a CVSS v3.1 base score of 5.3 and impacts only availability.

Affected Systems

The flaw exists only in Oracle Outside In Technology version 8.5.8, a component of Oracle Fusion Middleware. Users running that release and exposing the Clean Content SDK over HTTP are affected; Oracle Corporation is the vendor responsible.

Risk and Exploitability

The vulnerability can be exploited from a public HTTP interface and requires no authentication, making it relatively easy for an adversary on the same network or the internet to trigger. The CVSS score of 5.3 places it in the medium severity range. The EPSS score of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 23, 2026 at 06:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle‑provided patch for Oracle Outside In Technology 8.5.8 or later.
  • Reduce or eliminate exposure of the Clean Content SDK endpoint by configuring firewall rules or access control lists to block external HTTP traffic.
  • Disable the cleanup endpoint if it is not needed, or enforce authentication so only trusted users can use it.
  • Implement rate limiting, connection throttling, or other traffic controls on the HTTP interface to mitigate DoS impacts.

Generated by OpenCVE AI on October 23, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Partial DoS via Oracle Outside In Technology SDK

Fri, 23 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Partial Denial of Service via HTTP in Oracle Outside In Clean Content SDK
Weaknesses CWE-770

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Partial Denial of Service via HTTP in Oracle Outside In Clean Content SDK
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:23.868Z

Reserved: 2026-09-14T22:10:16.629Z

Link: CVE-2026-91352

cve-icon Vulnrichment

Updated: 2026-10-22T18:43:13.858Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:37.787

Modified: 2026-11-10T14:56:46.880

Link: CVE-2026-91352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T07:00:16Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption