{"id":"CVE-2026-87394","kind":"vulnerability","aliases":["CVE-2026-87394"],"related":[],"title":"Oracle Outside In: unauthenticated network flaw exposes critical data and causes partial DoS","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).","summary":"Oracle Outside In, a document-parsing library in Oracle Fusion Middleware, has a flaw reachable over HTTP without authentication. An attacker can read critical data accessible to the library and cause a partial denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","oracle-fusion-middleware","outside-in","package","self-hosted"],"not_affected_if":["no-http-exposure","no-outside-in-install"],"how_to_check":"- Check whether the application uses Oracle Outside In (Oracle Fusion Middleware) for document parsing or conversion.\n- Confirm the installed version: the affected supported version is `8.5.8`.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Outside In Technology; the sources do not name the patched version.\n- unknown","status":"open","published_at":"2026-10-20T22:20:17+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:04:04+00:00","updated_at":"2026-10-25T03:04:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:04:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Outside In Technology; the sources do not name the patched version.\n- unknown","reach":"internet","title":"Oracle Outside In: unauthenticated network flaw exposes critical data and causes partial DoS","impact":"high","summary":"Oracle Outside In, a document-parsing library in Oracle Fusion Middleware, has a flaw reachable over HTTP without authentication. An attacker can read critical data accessible to the library and cause a partial denial of service.","category":"package","nicknames":[],"who_cares":["oracle","oracle-fusion-middleware","outside-in","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads critical data and partially disrupts the service.","analyst_note":"Find the Oracle CPU advisory and the patched version for Outside In 8.5.8 at https://nvd.nist.gov/vuln/detail/CVE-2026-87394 and Oracle's security alerts page.","how_to_check":"- Check whether the application uses Oracle Outside In (Oracle Fusion Middleware) for document parsing or conversion.\n- Confirm the installed version: the affected supported version is `8.5.8`.","needs_analyst":true,"not_affected_if":["no-outside-in-install","no-http-exposure"],"who_is_affected":"Systems that run Oracle Outside In 8.5.8 and expose its document processing over HTTP are affected, since the attack needs no login and no user action. Teams that do not run Oracle Fusion Middleware or Outside In can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3504,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87394':16A,19A '/av':164C '3.1':152C,163C '8.2':155C '8.5.8':92C 'abil':136C 'access':58B,101C,119C,125C,132C 'affect':90C 'allow':96C 'attack':53B,98C,111C 'authent':51B 'avail':158C 'base':153C 'caus':11A,63B,138C 'complet':124C 'compon':81C 'compromis':105C 'confidenti':156C 'core':84C 'critic':8A,56B,121C 'cve':14A,17A 'cvss':151C,160C,162C 'data':9A,57B,122C,133C 'denial':66B,141C 'document':37B 'document-pars':36B 'dos':13A,145C 'easili':93C 'exploit':94C 'expos':7A 'flaw':6A,46B 'fusion':23B,42B,79C 'h/i':170C 'host':31B 'http':49B,103C 'impact':159C 'l':172C 'l/pr':166C 'librari':39B,61B 'middlewar':24B,43B,80C 'n/a':171C 'n/ac':165C 'n/s':168C 'n/ui':167C 'network':5A,100C 'oracl':1A,20B,22B,32B,41B,72C,78C,106C,128C,147C 'oracle-fusion-middlewar':21B 'outsid':2A,26B,33B,73C,82C,107C,129C,148C 'outside-in':25B 'packag':28B 'pars':38B 'partial':12A,65B,140C,144C 'product':76C 'reachabl':47B 'read':55B 'result':116C 'score':154C 'self':30B 'self-host':29B 'servic':68B,143C 'success':110C 'support':86C 'technolog':75C,109C,131C,150C 'u/c':169C 'unauthent':4A,97C 'unauthor':118C,135C 'vector':161C 'version':87C 'via':102C 'vulner':69C,95C,114C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Systems that run Oracle Outside In 8.5.8 and expose its document processing over HTTP are affected, since the attack needs no login and no user action. Teams that do not run Oracle Fusion Middleware or Outside In can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87394","severity":null,"published_at":"2026-10-20T22:20:17+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}