---
id: "CVE-2026-87397"
kind: "vulnerability"
aliases: ["CVE-2026-87397"]
title: "Oracle Outside In: unauthenticated network flaw lets attacker take over the library"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Outside In Technology", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fusion-middleware", "java", "oracle", "outside-in", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-outside-in-install"]
published_at: "2026-10-20T22:20:18+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:00:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87397", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:00:32+00:00"}]
---

# Oracle Outside In: unauthenticated network flaw lets attacker take over the library

Oracle Outside In Technology 8.5.8 (Outside In Core, Fusion Middleware) has an HTTP-reachable flaw that needs no login but needs a user to open a crafted file. A successful attack takes over the component (CVSS 8.8). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology affected 8.5.8 fixed ?

## How to check

Check whether Oracle Outside In Technology is installed and which version it is. Look in Oracle Fusion Middleware homes, or in any product or app that embeds the Outside In SDK for document conversion or preview. Version 8.5.8 is affected. Run 'opatch lsinventory' in the Oracle home and look for Outside In. Then compare against the patch listed in the October 2026 CPU patch availability document for Fusion Middleware.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware / Outside In Technology. The exact patched build is in the MOS patch availability document and was not readable without a login. Until you can patch, don't let Outside In process files from untrusted sources and limit network access to it.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87397
- 2026-10-24T00:00:32+00:00 analyst — Fix comes from Oracle's October 2026 CPU (2026-10-20), not April as triage said. The advisory lists Outside In Technology 8.5.8 as affected and points to the Fusion Middleware patch availability doc (MOS, login needed), so the patched build is unknown. No exploitation or PoC seen; X has 0 posts. I could not tell from the sources which other products bundle Outside In.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_