{"id":"CVE-2026-91343","kind":"vulnerability","aliases":["CVE-2026-91343"],"related":[],"title":"Oracle Outside In: unauthenticated network flaw lets attacker alter critical data","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).","summary":"Oracle Outside In Technology 8.5.8 (component Outside In Clean Content SDK) has an improper-authorization flaw (CWE-285 per VulDB) reachable by an unauthenticated attacker over HTTP. It allows unauthorized creation, deletion or modification of critical data (CVSS 3.1 8.6, vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Scope change means products that embed the SDK are also affected. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["http-services","oracle-fusion-middleware","other","outside-in-sdk"],"not_affected_if":["not-on-8.5.8"],"how_to_check":"Affected only if you run Outside In Technology 8.5.8, or an Oracle or third-party product that bundles the Outside In Clean Content SDK 8.5.8. Oracle's public pages give no install-version command. Check the SDK/library version in your product's install directory or release notes, or ask the vendor of the embedding product. Oracle customers can find it in MOS.","fix":"Apply the Oct 2026 Critical Patch Update patch for Oracle Outside In Technology (Fusion Middleware patch availability document, MOS note, login required). The public advisory does not name a fixed version: unknown. A MOS login would settle it.","status":"open","published_at":"2026-10-20T22:20:36+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:39:31+00:00","updated_at":"2026-10-23T23:55:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:39:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Outside In: unauthenticated network flaw lets attacker alter critical data","impact":"high","summary":"Oracle Outside In Clean Content SDK 8.5.8 has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation allows unauthorized creation, deletion or modification of critical data, and can affect other products through scope change.","category":"other","who_cares":["oracle-fusion-middleware","outside-in-sdk","http-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker creates, deletes or modifies critical data remotely without credentials","analyst_note":"Find the Oracle Critical Patch Update advisory naming the fixed Outside In Clean Content SDK version and the install-version check; the NVD entry in the sources does not give either.","how_to_check":"Check whether you run Oracle Outside In Clean Content SDK version 8.5.8. How to find the installed version on your systems is unknown.","needs_analyst":true,"not_affected_if":["not-on-8.5.8"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001007,"input_tokens":3106,"output_tokens":1392,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory naming the fixed Outside In Clean Content SDK version and the install-version check; the NVD entry in the sources does not give either.","search":"'-2026':13A,16A '-285':52B '-91343':14A,17A '/av':204C '2026':101B '3.1':73B,194C,203C '8.5.8':38B,133C '8.6':74B,197C 'access':142C,181C,191C 'addit':164C 'affect':95B,131C 'allow':63B,137C 'also':94B 'alter':9A 'attack':8A,59B,139C,160C,169C 'author':49B 'av':76B 'base':195C 'c/c':81B,209C 'chang':86B,167C 'clean':42B,123C 'compon':39B,120C 'compromis':146C 'content':43B,124C 'creation':65B,177C 'critic':10A,70B,102B,183C 'cve':12A,15A 'cvss':72B,193C,200C,202C 'cwe':51B 'data':11A,71B,184C,192C 'delet':66B,178C 'easili':134C 'emb':90B 'exploit':107B,135C 'fix':96B 'flaw':6A,50B 'fusion':27B,118C 'h/a':83B,211C 'http':23B,61B,144C 'http-servic':22B 'impact':163C,199C 'improp':48B 'improper-author':47B 'in':20A 'integr':198C 'known':106B 'l/pr':78B,206C 'let':7A 'may':161C 'mean':87B 'middlewar':28B,119C 'modif':68B,180C 'n':84B,212C 'n/ac':77B,205C 'n/i':82B,210C 'n/s':80B,208C 'n/ui':79B,207C 'network':5A,141C 'octob':100B 'oracl':1A,26B,34B,98B,111C,117C,147C,156C,187C 'oracle':18A 'oracle-fusion-middlewar':25B 'outsid':2A,31B,35B,40B,112C,121C,148C,157C,188C 'outside':19A 'outside-in-sdk':30B 'patch':103B 'per':53B 'product':88B,115C,165C 'reachabl':55B 'result':174C 'scope':85B,166C 'score':196C 'sdk':33B,44B,92B,125C 'servic':24B 'signific':162C 'success':168C 'support':127C 'technolog':37B,114C,150C,159C,190C 'technology':21A 'unauthent':4A,58B,138C 'unauthor':64B,176C 'updat':104B 'vector':75B,201C 'version':128C 'via':143C 'vuldb':54B 'vulner':108C,136C,153C,172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91343","severity":null,"published_at":"2026-10-20T22:20:36+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91343:548","url":null,"severity":null,"published_at":"2026-10-23T23:55:15+00:00","modified_at":"2026-10-23T23:55:15+00:00","first_seen_at":"2026-10-23T23:55:15+00:00","fetched_at":"2026-10-23T23:55:15+00:00","note":"Oracle CPU Oct 2026 lists Outside In Technology 8.5.8 (Fusion Middleware); patch details are in the MOS patch availability document (login needed), so no fixed version number is published publicly. No exploitation or PoC found (Armis, VulDB). Did not search social posts; likely little discussion."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2256,"url":"https://cve.armis.com/CVE-2026-91343","title":"CVE-2026-91343 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}