---
id: "CVE-2026-87394"
kind: "vulnerability"
aliases: ["CVE-2026-87394"]
title: "Oracle Outside In: unauthenticated network flaw exposes critical data and causes partial DoS"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["oracle", "oracle-fusion-middleware", "outside-in", "package", "self-hosted"]
not_affected_if: ["no-http-exposure", "no-outside-in-install"]
published_at: "2026-10-20T22:20:17+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:04:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87394", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Outside In: unauthenticated network flaw exposes critical data and causes partial DoS

Oracle Outside In, a document-parsing library in Oracle Fusion Middleware, has a flaw reachable over HTTP without authentication. An attacker can read critical data accessible to the library and cause a partial denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application uses Oracle Outside In (Oracle Fusion Middleware) for document parsing or conversion.
- Confirm the installed version: the affected supported version is `8.5.8`.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Outside In Technology; the sources do not name the patched version.
- unknown

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87394

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_