Vulnerability in the Outside In Clean Content SDK of Oracle Outside In Technology 8.5.8 allows a low‑privileged user with local access to the host to create, delete, or modify protected data, read restricted data, and trigger a partial denial of service. The flaw results in violations of confidentiality, integrity, and availability and is categorized as improper authorization (CWE‑284).

Oracle Outside In Technology version 8.5.8, a component of Oracle Fusion Middleware, is affected. No other versions are listed as impacted in the official advisory.

The CVSS base score of 6.6 indicates medium severity with a local attack vector, low privileges, and no user interaction. EPSS <1% shows a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalogue, implying no known active exploitation. Nonetheless, the requirement of an existing low‑privileged host account means the practical risk in environments where such accounts exist is non‑negligible, enabling attackers to breach confidentiality and integrity while also causing partial service disruptions.