Oracle Outside In Technology version 8.5.8 contains a vulnerability in the Outside In Clean Content SDK that an attacker can exploit through a crafted HTTP request. The flaw allows a low‑privileged attacker who can reach the service over the network to completely take over the product, compromising confidentiality, integrity, and availability of the environment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and a base score of 9.9 indicate a critical rating with full control granted to an exploit. Affected systems and product scope: The affected component is the Outside In Clean Content SDK within Oracle Outside In Technology, a product of Oracle Corporation. Only the 8.5.8 release is listed as vulnerable; however, the scope change in the vector (C) means a successful exploit can impact other Oracle products deployed in the same environment. Risk and exploitability: A CVSS score of 9.9 reflects the severity of the issue, while an EPSS score of less than 1% indicates a low probability of exploitation in the short term, yet the vulnerability is described as easily exploitable and is not yet listed in the CISA KEV catalog. The attack requires network access (AV:N) and low privileges (PR:L), making it feasible for remote attackers with minimal credentials, especially if the service is exposed to untrusted networks.

Affected product: Oracle Outside In Technology (Oracle Corporation). Component: Outside In Clean Content SDK. Vulnerable version: 8.5.8. No other versions are listed as affected.

The CVSS 3.1 9.9 score classifies this flaw as Critical; the nuclear impact surfaces through the scope change (S:C), allowing the attacker to affect other components within the same deployment. The EPSS score of <1% suggests that automated attacks are currently rare, but the simple, network‑based nature of the exploit and the low privilege requirement mean that once the vulnerability is known, exploitation could become widespread. The vulnerability is not present in the CISA KEV catalog, but its severity warrants immediate attention by administrators to limit exposure and apply fixes.