---
id: "CVE-2026-87393"
kind: "vulnerability"
aliases: ["CVE-2026-87393"]
title: "Oracle Outside In: crafted file input can crash the document parser"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fusion-middleware", "oracle", "outside-in", "package", "self-hosted"]
not_affected_if: ["no-outside-in-usage"]
published_at: "2026-10-20T22:20:17+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:51:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87393", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Outside In: crafted file input can crash the document parser

Oracle Outside In Technology 8.5.8 has a flaw that lets an unauthenticated network attacker send content over HTTP that hangs or repeatedly crashes the library. The impact is denial of service, with no data read or code run according to the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application bundles or links Oracle Outside In Technology 8.5.8 (unknown for other versions)
- Look for the Outside In library in the deployed Oracle Fusion Middleware installation

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87393

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_