---
id: "CVE-2026-91340"
kind: "vulnerability"
aliases: ["CVE-2026-91340"]
title: "Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over"
severity: "high"
cvss: 8.8
epss: 0.00447
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Outside In Technology (Clean Content SDK)", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fusion-middleware", "oracle", "outside-in", "package", "self-hosted"]
not_affected_if: ["not-using-outside-in", "unknown"]
published_at: "2026-10-20T22:20:36+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91340", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:56:06+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91340", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take over

Oracle Outside In Technology 8.5.8 (Clean Content SDK, part of Oracle Fusion Middleware) has a flaw that lets a low-privileged attacker with network access over HTTP take over the component. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in the Oracle October 2026 Critical Patch Update; no exploitation reported in the sources read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology (Clean Content SDK) affected 8.5.8 fixed ?

## How to check

Find where Oracle Outside In Technology is installed. It is usually embedded in Oracle Fusion Middleware or in products that bundle the SDK, and Oracle does not ship it as a standalone download. Check the version: 8.5.8 is affected. Also check whether the Clean Content SDK is reachable over HTTP by low-privileged users.

## Fix

Apply the Oracle October 2026 Critical Patch Update to the Fusion Middleware installation that hosts Outside In Technology (https://www.oracle.com/security-alerts/cpuoct2026.html). The exact fixed version is not public and is listed in the My Oracle Support patch documents. Until patched, restrict HTTP access to the SDK endpoint to trusted, authenticated users and limit which accounts can submit content.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91340
- 2026-10-23T23:56:06+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) and Armis confirm only Outside In Technology 8.5.8 (Fusion Middleware, Clean Content SDK) is affected; fixed version number not public (behind My Oracle Support). No exploitation or PoC found in sources; social search not done.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91340

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mitigation] Armis: CVE-2026-91340 https://cve.armis.com/CVE-2026-91340

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_