Oracle Outside In Technology contains an input validation and authorization flaw in the Outside In Image Export SDK that permits an unauthenticated local attacker with a logged‑on session on the host to compromise the component. If a user other than the attacker initiates the export operation, the attacker can trigger the flaw, resulting in full takeover of the application with impacts on confidentiality, integrity, and availability.

Affected installations are Oracle Outside In Technology version 8.5.8 within Oracle Fusion Middleware. The flaw resides in the Outside In Image Export SDK component.

The CVSS v3.1 base score of 7.8 indicates high severity. The attack vector is local with user interaction (AV:L/ UI:R). No privileges or authentication are required against the Oracle software itself (PR:N, S:U). The EPSS score is less than 1 %—a very low but non‑zero likelihood of exploitation. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, but its potential to compromise the application makes it a significant risk.