A flaw in the Outside In PDF Export SDK lets an unauthenticated network user send crafted HTTP requests that trigger the execution of arbitrary code within Oracle Outside In Technology. The vulnerability results from improper input validation (CWE‑20), allowing an attacker to compromise the confidentiality, integrity, and availability of the affected system. Successful exploitation requires human interaction from a user other than the attacker and can lead to a full takeover of Oracle Outside In Technology.

Oracle Outside In Technology, version 8.5.8, part of Oracle Fusion Middleware. The issue is confined to the PDF Export SDK component in that product release.

The CVSS v3.1 score of 7.5 reflects high severity, while the EPSS score of < 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires unauthenticated network access to a publicly exposed HTTP endpoint and relies on a victim user to trigger the vulnerable request, making the attack vector a network‑based, user‑interaction scenario.