---
id: "CVE-2026-91341"
kind: "vulnerability"
aliases: ["CVE-2026-91341"]
title: "Oracle Outside In Content SDK: remote unauthenticated flaw allows tampering and crashes"
severity: "critical"
cvss: 9.1
epss: 0.00441
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Outside In Technology", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["clean-content-sdk", "document-processing", "oracle-fusion-middleware", "oracle-outside-in", "other", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:36+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91341", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:57:23+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91341", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In Content SDK: remote unauthenticated flaw allows tampering and crashes

Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK component) has an easily exploitable flaw reachable by an unauthenticated attacker over HTTP. Impact is unauthorized creation, modification or deletion of data plus a repeatable hang or crash. Oracle rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N, I:H/A:H). Fixed in the October 2026 Critical Patch Update, but the public advisory gives no fixed version number.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology affected 8.5.8 fixed ?

## How to check

Find out whether you run Oracle Outside In Technology 8.5.8, standalone or bundled in an Oracle product such as WebCenter Content or Fusion Middleware, and whether the Clean Content SDK is reachable over HTTP. Oracle does not ship Outside In as a standalone download, so check your Oracle product's installed patch level or inventory (for example OPatch lsinventory) against the October 2026 CPU.

## Fix

Apply the Oracle Critical Patch Update of October 20, 2026 for Fusion Middleware (Outside In Technology), using the patch availability document on My Oracle Support. The exact fixed Outside In version is unknown from public pages; the MOS patch document would settle it. Until patched, restrict network access to any HTTP service exposing the Clean Content SDK.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91341
- 2026-10-23T22:57:23+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) lists Outside In Technology 8.5.8 under Fusion Middleware patch doc; no fixed version number is published on the public page (patch doc is on My Oracle Support). CVSS 9.1 per Oracle. No exploitation or PoC reported in sources read (Armis, VulDB). No social search done.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91341

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91341 https://www.cve.org/CVERecord?id=CVE-2026-91341

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_