This vulnerability is a flash point that allows an adversary who can reach the Oracle Outside In Technology services over HTTP without authentication to obtain full access to any data that the service can read. Because the flaw is in the Clean Content SDK component, the attacker can bypass normal authorization, meaning that confidential or critical information could be disclosed or manipulated. The weakness leads to a loss of confidentiality and potential data integrity compromise for systems that rely on this library.

Oracle Outside In Technology version 8.5.8 is impacted. The problem resides in the Outside In Clean Content SDK component of Oracle Fusion Middleware. Any deployment of this version that exposes the service to the network is susceptible; related products may also be affected through a scope change.

The CVSS v3.1 base score of 8.6 indicates a high–severity vulnerability with network–level attack vector, no authentication, and a single user impact dominated by confidentiality. The EPSS score of 0.4% indicates a very low, but nonzero probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Nevertheless, the description states it is "easily exploitable" by unauthenticated HTTP traffic, so the chance of successful attacks in environments where the component is exposed is significant. The scope change suggests that other Oracle Fusion Middleware components could be compromised if not isolated.