The vulnerability in Oracle Outside In Technology allows an unauthenticated local attacker with system logon to compromise the component. It relies on unsafe serialization (CWE‑502). Successful attacks require user interaction from a person other than the attacker and, if successful, could lead to complete takeover, resulting in full confidentiality, integrity and availability impacts.

The affected product is Oracle Outside In Technology version 8.5.8, part of Oracle Fusion Middleware. It is distributed by Oracle Corporation under the Oracle Outside In Technology product line.

The CVSS 3.1 base score is 7.8, indicating a high level of severity. The attack vector is local with low attack complexity and no privileges, though user interaction is required. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. With local access and user interaction, the risk to the organization is significant, especially if the infrastructure is maintained by untrusted personnel.