The vulnerability resides in the Outside In Image Export SDK of Oracle Outside In Technology 8.5.8. An unauthenticated attacker who can log on to the infrastructure where the product runs can trigger the flaw to compromise the application, potentially gaining full control. The issue stems from insecure deserialization (CWE‑502). Successful exploitation would allow the attacker to read, modify or delete data and disrupt availability, as reflected by the CVSS 3.1 base score of 7.8.

Oracle Outside In Technology, part of the Oracle Fusion Middleware suite, with affected version 8.5.8.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% implies a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers require local access to the host and must involve a user other than themselves to supply input that triggers the export SDK. Because these constraints narrow the attack surface, the overall risk is significant for environments that allow local logon.