Description
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Read Access
Action: Apply Patch
AI Analysis

Impact

The Oracle Outside In Technology product contains a flaw in the Outside In PDF Export SDK that allows an unauthenticated attacker who can log onto the same infrastructure to read a subset of data stored by Oracle Outside In Technology. The vulnerability can be exploited locally without requiring elevated privileges and is classified as a confidentiality impact only, with no disruption to availability or integrity.

Affected Systems

This issue affects Oracle Outside In Technology version 8.5.8, which is part of Oracle Fusion Middleware and operates within the Outside In PDF Export SDK component. Systems running this version are at risk, while newer or patched releases are not impacted.

Risk and Exploitability

The CVSS 3.1 Base Score is 4.0, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local—the attacker must have logon to the server running Outside In Technology—and the CVE description does not provide an estimate of exploitation probability.

Generated by OpenCVE AI on October 21, 2026 at 13:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Follow the Oracle CPU Oct 2026 advisory and apply the available patch that addresses the PDF Export SDK vulnerability in version 8.5.8, or upgrade to a newer release.
  • Restrict network access to the Oracle Outside In Technology instance to authorized personnel only, using firewall rules and network segmentation to prevent exposure to external attackers who might gain local access.
  • Review data exposure settings for the PDF Export SDK and enforce least‑privilege practices to limit read permissions on exported content, ensuring that only required data is exposed.

Generated by OpenCVE AI on October 21, 2026 at 13:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via Oracle Outside In PDF Export SDK
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle outside In Technology
CPEs cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outside In Technology
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Outside In Technology
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T19:51:41.872Z

Reserved: 2026-09-14T22:10:16.632Z

Link: CVE-2026-91404

cve-icon Vulnrichment

Updated: 2026-10-23T19:51:37.546Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:43.693

Modified: 2026-11-04T14:22:26.760

Link: CVE-2026-91404

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T16:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor