The vulnerability is located in the Outside In Clean Content SDK component of Oracle Outside In Technology and allows an unauthenticated attacker who can log on to the infrastructure where the product executes to gain full control of the application. A CVSS 3.1 Base Score of 8.4 indicates high confidentiality, integrity, and availability impact. The description states that an unauthenticated attacker who can log on to the infrastructure where Oracle Outside In Technology runs can compromise the product, which could lead to a full takeover of the application and the data it protects.

Oracle Outside In Technology version 8.5.8, part of Oracle Fusion Middleware, is the only supported version affected. Distributed by Oracle Corporation.

The CVSS score of 8.4 indicates a severe threat. The EPSS score of <1% indicates a very low but non‑zero exploitation probability. Because the vulnerability requires an attacker to have logon access to the infrastructure where Oracle Outside In Technology runs, the likely attack vector is a local or privileged user who has already authenticated to the host. The vulnerability arises from the product's failure to enforce appropriate authentication or access controls, allowing that attacker to take over the Oracle Outside In Technology service. Although the entry is not listed in the CISA KEV catalog, the potential damage from a successful exploit is significant, as it could lead to comprehensive compromise of the application and its data it protects.