{"id":"CVE-2026-91340","kind":"vulnerability","aliases":["CVE-2026-91340"],"related":[],"title":"Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Outside In Technology 8.5.8 (Clean Content SDK, part of Oracle Fusion Middleware) has a flaw that lets a low-privileged attacker with network access over HTTP take over the component. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in the Oracle October 2026 Critical Patch Update; no exploitation reported in the sources read.","severity":"high","cvss":8.8,"epss":0.00447,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology (Clean Content SDK)","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fusion-middleware","oracle","outside-in","package","self-hosted"],"not_affected_if":["not-using-outside-in","unknown"],"how_to_check":"Find where Oracle Outside In Technology is installed. It is usually embedded in Oracle Fusion Middleware or in products that bundle the SDK, and Oracle does not ship it as a standalone download. Check the version: 8.5.8 is affected. Also check whether the Clean Content SDK is reachable over HTTP by low-privileged users.","fix":"Apply the Oracle October 2026 Critical Patch Update to the Fusion Middleware installation that hosts Outside In Technology (https://www.oracle.com/security-alerts/cpuoct2026.html). The exact fixed version is not public and is listed in the My Oracle Support patch documents. Until patched, restrict HTTP access to the SDK endpoint to trusted, authenticated users and limit which accounts can submit content.","status":"open","published_at":"2026-10-20T22:20:36+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:02+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for Outside In Technology; the patched version is unknown from the sources.","reach":"network","title":"Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over","impact":"high","summary":"Oracle Outside In Technology's Clean Content SDK version 8.5.8 has a flaw that lets a low-privilege attacker over HTTP compromise the product. Per the CVSS vector, a successful attack gives full confidentiality, integrity and availability impact.","category":"package","who_cares":["oracle","fusion-middleware","outside-in"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the product, with full read, write and availability impact","analyst_note":"Find the patched version and Oracle CPU advisory for CVE-2026-91340 at https://nvd.nist.gov/vuln/detail/CVE-2026-91340; sources do not name the fix or confirm default configuration.","how_to_check":"Check whether the Outside In Clean Content SDK 8.5.8 is in use in your applications or Fusion Middleware deployments.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000538,"input_tokens":3071,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory or the NVD entry for the patched version and the exact HTTP-facing product that embeds Outside In Clean Content SDK 8.5.8.","search":"'-2026':16A,19A '-91340':17A,20A '/av':168C '2026':85B '3.1':72B,155C,167C '8.5.8':43B,121C '8.8':74B,158C 'access':64B,131C 'affect':119C 'allow':125C 'attack':61B,128C,141C 'av':75B 'avail':162C 'base':156C 'clean':4A,25A,44B,111C 'compon':70B,108C 'compromis':135C 'confidenti':159C 'content':5A,26A,45B,112C 'critic':86B 'cve':15A,18A 'cvss':71B,154C,164C,166C 'easili':122C 'exploit':90B,123C 'fix':80B 'flaw':8A,54B 'fusion':29B,50B,106C 'fusion-middlewar':28B 'h':176C 'h/a':175C 'h/i':174C 'host':38B 'http':66B,133C 'impact':163C 'in':23A 'integr':160C 'l/pr':77B,170C 'l/ui':78B,171C 'let':9A,56B 'low':11A,59B,126C 'low-privileg':10A,58B 'middlewar':30B,51B,107C 'n':79B 'n/ac':76B,169C 'n/s':172C 'network':7A,63B,130C 'octob':84B 'oracl':1A,31B,39B,49B,83B,99C,105C,136C,150C 'oracle':21A 'outsid':2A,33B,40B,100C,109C,137C,151C 'outside':22A 'outside-in':32B 'packag':35B 'part':47B 'patch':87B 'privileg':12A,60B,127C 'product':103C 'read':95B 'report':91B 'result':146C 'score':157C 'sdk':6A,27A,46B,113C 'self':37B 'self-host':36B 'sourc':94B 'success':140C 'support':115C 'take':14A,67B 'takeov':148C 'technolog':42B,102C,139C,153C 'technology':24A 'u/c':173C 'updat':88B 'user':13A 'vector':165C 'version':116C 'via':132C 'vulner':96C,124C,144C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91340","severity":null,"published_at":"2026-10-20T22:20:36+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91340:549","url":null,"severity":null,"published_at":"2026-10-23T23:56:06+00:00","modified_at":"2026-10-23T23:56:06+00:00","first_seen_at":"2026-10-23T23:56:06+00:00","fetched_at":"2026-10-23T23:56:06+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) and Armis confirm only Outside In Technology 8.5.8 (Fusion Middleware, Clean Content SDK) is affected; fixed version number not public (behind My Oracle Support). No exploitation or PoC found in sources; social search not done."},{"source":"epss","external_id":"CVE-2026-91340","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91340","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2260,"url":"https://cve.armis.com/CVE-2026-91340","title":"Armis: CVE-2026-91340","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}