{"id":"CVE-2026-91341","kind":"vulnerability","aliases":["CVE-2026-91341"],"related":[],"title":"Oracle Outside In Content SDK: remote unauthenticated flaw allows tampering and crashes","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","summary":"Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK component) has an easily exploitable flaw reachable by an unauthenticated attacker over HTTP. Impact is unauthorized creation, modification or deletion of data plus a repeatable hang or crash. Oracle rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N, I:H/A:H). Fixed in the October 2026 Critical Patch Update, but the public advisory gives no fixed version number.","severity":"critical","cvss":9.1,"epss":0.00441,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["clean-content-sdk","document-processing","oracle-fusion-middleware","oracle-outside-in","other","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Find out whether you run Oracle Outside In Technology 8.5.8, standalone or bundled in an Oracle product such as WebCenter Content or Fusion Middleware, and whether the Clean Content SDK is reachable over HTTP. Oracle does not ship Outside In as a standalone download, so check your Oracle product's installed patch level or inventory (for example OPatch lsinventory) against the October 2026 CPU.","fix":"Apply the Oracle Critical Patch Update of October 20, 2026 for Fusion Middleware (Outside In Technology), using the patch availability document on My Oracle Support. The exact fixed Outside In version is unknown from public pages; the MOS patch document would settle it. Until patched, restrict network access to any HTTP service exposing the Clean Content SDK.","status":"open","published_at":"2026-10-20T22:20:36+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:05+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:34:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Outside In Content SDK: remote unauthenticated flaw allows tampering and crashes","impact":"high","summary":"Oracle Outside In Clean Content SDK version 8.5.8 has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation lets the attacker create, modify or delete critical data and crash or hang the service repeatedly.","category":"other","who_cares":["oracle-fusion-middleware","oracle-outside-in","document-processing"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated remote attacker modifies or deletes critical data, or crashes the service","analyst_note":"Find the Oracle patch or fixed version for Outside In Clean Content SDK 8.5.8 in the Oracle Security Alerts or Critical Patch Update advisories; NVD gives no fix.","how_to_check":"Check whether you run the Oracle Outside In Clean Content SDK, and which version: the affected version is listed as 8.5.8.","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001025,"input_tokens":3145,"output_tokens":1420,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle patch or fixed version for Outside In Clean Content SDK 8.5.8 in the Oracle Security Alerts or Critical Patch Update advisories; NVD gives no fix.","search":"'-2026':14A,17A '-91341':15A,18A '/av':210C '2026':98B '3.1':84B,198C,209C '8.5.8':46B,136C '9.1':85B,201C 'abil':181C 'access':145C,167C,177C 'advisori':105B 'affect':134C 'allow':9A,140C 'attack':62B,142C,155C 'av':86B 'avail':204C 'base':199C 'caus':183C 'clean':24B,49B,126C 'clean-content-sdk':23B 'complet':190C 'compon':52B,123C 'compromis':149C 'content':4A,25B,50B,127C 'crash':12A,79B,189C 'creation':68B,163C 'critic':99B,169C 'cve':13A,16A 'cvss':83B,197C,206C,208C 'data':73B,170C,178C 'delet':71B,164C 'document':28B 'document-process':27B 'dos':191C 'easili':55B,137C 'exploit':56B,138C 'fix':94B,108B 'flaw':8A,57B 'frequent':187C 'fusion':32B,121C 'give':106B 'h':93B,218C 'h/a':92B,217C 'hang':77B,185C 'host':41B 'http':64B,147C 'impact':65B,205C 'in':21A 'integr':202C 'l/pr':88B,212C 'middlewar':33B,122C 'modif':69B,166C 'n':90B 'n/ac':87B,211C 'n/i':216C 'n/s':214C 'n/ui':89B,213C 'network':144C 'number':110B 'octob':97B 'oracl':1A,31B,35B,42B,80B,114C,120C,150C,173C,193C 'oracle':19A 'oracle-fusion-middlewar':30B 'oracle-outside-in':34B 'outsid':2A,36B,43B,47B,115C,124C,151C,174C,194C 'outside':20A 'patch':100B 'plus':74B 'process':29B 'product':118C 'public':104B 'rate':81B 'reachabl':58B 'remot':6A 'repeat':76B,188C 'result':160C 'score':200C 'sdk':5A,26B,51B,128C 'self':40B 'self-host':39B 'success':154C 'support':130C 'tamper':10A 'technolog':45B,117C,153C,176C,196C 'technology':22A 'u/c':215C 'unauthent':7A,61B,141C 'unauthor':67B,162C,180C 'updat':101B 'vector':207C 'version':109B,131C 'via':146C 'vulner':111C,139C,158C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91341","severity":null,"published_at":"2026-10-20T22:20:36+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91341:335","url":null,"severity":null,"published_at":"2026-10-23T22:57:23+00:00","modified_at":"2026-10-23T22:57:23+00:00","first_seen_at":"2026-10-23T22:57:23+00:00","fetched_at":"2026-10-23T22:57:23+00:00","note":"Oracle CPU Oct 2026 (Oct 20) lists Outside In Technology 8.5.8 under Fusion Middleware patch doc; no fixed version number is published on the public page (patch doc is on My Oracle Support). CVSS 9.1 per Oracle. No exploitation or PoC reported in sources read (Armis, VulDB). No social search done."},{"source":"epss","external_id":"CVE-2026-91341","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91341","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1698,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91341","title":"CVE Record: CVE-2026-91341","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}