{"id":"CVE-2026-87304","kind":"vulnerability","aliases":["CVE-2026-87304"],"related":[],"title":"Oracle Outside In: unauthenticated network flaw exposes accessible data to attackers","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Outside In is a document-filtering library in Oracle Fusion Middleware. An unauthenticated attacker who can send HTTP requests can gain unauthorized access to critical data, potentially reaching all data the product can access, and the impact may extend to other products.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-outside-in","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:07+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:39:37+00:00","updated_at":"2026-10-23T22:39:37+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Outside In: unauthenticated network flaw exposes accessible data to attackers","impact":"high","summary":"Oracle Outside In is a document-filtering library in Oracle Fusion Middleware. An unauthenticated attacker who can send HTTP requests can gain unauthorized access to critical data, potentially reaching all data the product can access, and the impact may extend to other products.","category":"other","who_cares":["oracle-outside-in","oracle-fusion-middleware"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated remote attacker reads critical data, possibly affecting other products","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000845,"input_tokens":3096,"output_tokens":1071,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87304':14A,17A '/av':162C '3.1':152C,161C '8.5.8':92C '8.6':155C 'access':8A,49B,60B,101C,136C,142C,149C 'addit':123C 'affect':90C 'allow':96C 'attack':11A,40B,98C,119C,128C 'base':153C 'c/c':167C 'chang':126C 'complet':141C 'compon':81C 'compromis':105C 'confidenti':156C 'core':84C 'critic':51B,138C 'cve':12A,15A 'cvss':151C,158C,160C 'data':9A,52B,56B,139C,150C 'document':31B 'document-filt':30B 'easili':93C 'exploit':94C 'expos':7A 'extend':65B 'filter':32B 'flaw':6A 'fusion':20B,36B,79C 'gain':47B 'h/i':168C 'http':44B,103C 'impact':63B,122C,157C 'l/pr':164C 'librari':33B 'may':64B,120C 'middlewar':21B,37B,80C 'n':170C 'n/a':169C 'n/ac':163C 'n/s':166C 'n/ui':165C 'network':5A,100C 'oracl':1A,19B,23B,25B,35B,72C,78C,106C,115C,145C 'oracle-fusion-middlewar':18B 'oracle-outside-in':22B 'outsid':2A,24B,26B,73C,82C,107C,116C,146C 'potenti':53B 'product':58B,68B,76C,124C 'reach':54B 'request':45B 'result':133C 'scope':125C 'score':154C 'send':43B 'signific':121C 'success':127C 'support':86C 'technolog':75C,109C,118C,148C 'unauthent':4A,39B,97C 'unauthor':48B,135C 'vector':159C 'version':87C 'via':102C 'vulner':69C,95C,112C,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87304","severity":null,"published_at":"2026-10-20T22:20:07+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}