How do I check whether I am affected by CVE-2026-91340?

Find where Oracle Outside In Technology is installed. It is usually embedded in Oracle Fusion Middleware or in products that bundle the SDK, and Oracle does not ship it as a standalone download. Check the version: 8.5.8 is affected. Also check whether the Clean Content SDK is reachable over HTTP by low-privileged users.

What is the fix for CVE-2026-91340?

Apply the Oracle October 2026 Critical Patch Update to the Fusion Middleware installation that hosts Outside In Technology (https://www.oracle.com/security-alerts/cpuoct2026.html). The exact fixed version is not public and is listed in the My Oracle Support patch documents. Until patched, restrict HTTP access to the SDK endpoint to trusted, authenticated users and limit which accounts can submit content.

Who is not affected by CVE-2026-91340?

Not affected if: not-using-outside-in, unknown.

Live › vulnerability › CVE-2026-91340

Go to dashboard

high8.8Package

Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over

Oracle Outside In Technology 8.5.8 (Clean Content SDK, part of Oracle Fusion Middleware) has a flaw that lets a low-privileged attacker with network access over HTTP take over the component. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in the Oracle October 2026 Critical Patch Update; no exploitation reported in the sources read.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the product, with full read, write and availability impact.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91340

Go to dashboard

high8.8Package

Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the product, with full read, write and availability impact.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources