The Oracle Outside In Technology product contains a deserialization flaw classified as CWE‑502, in the Outside In Image Export SDK. This defect allows an attacker who has local access to the infrastructure on which the product runs to deliver malicious serialized payloads without prior authentication. If executed, the malicious data can be deserialized and processed, resulting in arbitrary code execution and the full takeover of the Oracle Outside In Technology instance. The CVSS base score of 7.8 reflects substantial confidentiality, integrity, and availability impacts.

Oracle Corporation’s Oracle Outside In Technology product, version 8.5.8.

Exploitation requires local access (attack vector AV:L) and a voluntary interaction from a non‑attacker user (UI:R). The attacker does not need privileged credentials, but must log on to the infrastructure where the product executes. The low EPSS score (< 1 %) indicates a very small probability of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw can lead to arbitrary code execution within the application and the vulnerability’s high impact score, operators should treat it as high‑risk and address it promptly.