{"id":"CVE-2026-87397","kind":"vulnerability","aliases":["CVE-2026-87397"],"related":[],"title":"Oracle Outside In: unauthenticated network flaw lets attacker take over the library","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Outside In Technology 8.5.8 (Outside In Core, Fusion Middleware) has an HTTP-reachable flaw that needs no login but needs a user to open a crafted file. A successful attack takes over the component (CVSS 8.8). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["fusion-middleware","java","oracle","outside-in","package","self-hosted"],"not_affected_if":["managed-hosting","no-outside-in-install"],"how_to_check":"Check whether Oracle Outside In Technology is installed and which version it is. Look in Oracle Fusion Middleware homes, or in any product or app that embeds the Outside In SDK for document conversion or preview. Version 8.5.8 is affected. Run 'opatch lsinventory' in the Oracle home and look for Outside In. Then compare against the patch listed in the October 2026 CPU patch availability document for Fusion Middleware.","fix":"Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware / Outside In Technology. The exact patched build is in the MOS patch availability document and was not readable without a login. Until you can patch, don't let Outside In process files from untrusted sources and limit network access to it.","status":"open","published_at":"2026-10-20T22:20:18+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:33+00:00","updated_at":"2026-10-24T00:00:32+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:34:33Z","model":"claude-haiku-5-5","output":{"fix":"Move Outside In Technology past 8.5.8 using Oracle's April 2026 Critical Patch Update; exact patched version unknown from sources.","reach":"internet","title":"Oracle Outside In: unauthenticated network flaw lets attacker take over the library","impact":"high","summary":"Oracle Outside In is a document-parsing library shipped inside Oracle Fusion Middleware. An unauthenticated remote attacker can take over the component over HTTP if a victim opens a crafted file or page.","category":"package","who_cares":["oracle","fusion-middleware","outside-in","java"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker takes over the Outside In component, reading and changing data","analyst_note":"Find the patched version and the Oracle CPU advisory for CVE-2026-87397 at https://nvd.nist.gov/vuln/detail/CVE-2026-87397 and confirm which products bundle Outside In 8.5.8.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-outside-in-install"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000518,"input_tokens":3087,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched version and the Oracle CPU advisory for CVE-2026-87397 at https://nvd.nist.gov/vuln/detail/CVE-2026-87397 and confirm which products bundle Outside In 8.5.8.","search":"'-2026':14A,17A '-87397':15A,18A '/av':166C '2026':78B '3.1':153C,165C '8.5.8':39B,108C '8.8':72B,156C 'access':117C 'affect':106C 'allow':112C 'attack':8A,66B,114C,127C,137C,139C 'avail':160C 'base':154C 'compon':70B,97C 'compromis':121C 'confidenti':157C 'core':42B,100C 'craft':62B 'critic':79B 'cve':13A,16A 'cvss':71B,152C,162C,164C 'easili':109C 'exploit':84B,110C 'file':63B 'fix':73B 'flaw':6A,50B 'fusion':24B,43B,95C 'fusion-middlewar':23B 'h':174C 'h/a':173C 'h/i':172C 'host':34B 'http':48B,119C 'http-reachabl':47B 'human':129C 'impact':161C 'in':21A 'integr':158C 'interact':130C 'java':26B 'known':83B 'l/pr':168C 'let':7A 'librari':12A 'login':54B 'middlewar':25B,44B,96C 'n/ac':167C 'n/ui':169C 'need':52B,56B 'network':5A,116C 'octob':77B 'open':60B 'oracl':1A,27B,35B,75B,88C,94C,122C,148C 'oracle':19A 'outsid':2A,29B,36B,40B,89C,98C,123C,149C 'outside':20A 'outside-in':28B 'packag':31B 'patch':80B 'person':133C 'product':92C 'r/s':170C 'reachabl':49B 'requir':128C 'result':144C 'score':155C 'self':33B 'self-host':32B 'success':65B,126C,138C 'support':102C 'take':9A,67B 'takeov':146C 'technolog':38B,91C,125C,151C 'technology':22A 'u/c':171C 'unauthent':4A,113C 'updat':81B 'user':58B 'vector':163C 'version':103C 'via':118C 'vulner':85C,111C,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87397","severity":null,"published_at":"2026-10-20T22:20:18+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87397:566","url":null,"severity":null,"published_at":"2026-10-24T00:00:32+00:00","modified_at":"2026-10-24T00:00:32+00:00","first_seen_at":"2026-10-24T00:00:32+00:00","fetched_at":"2026-10-24T00:00:32+00:00","note":"Fix comes from Oracle's October 2026 CPU (2026-10-20), not April as triage said. The advisory lists Outside In Technology 8.5.8 as affected and points to the Fusion Middleware patch availability doc (MOS, login needed), so the patched build is unknown. No exploitation or PoC seen; X has 0 posts. I could not tell from the sources which other products bundle Outside In."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}