---
id: "CVE-2026-91343"
kind: "vulnerability"
aliases: ["CVE-2026-91343"]
title: "Oracle Outside In: unauthenticated network flaw lets attacker alter critical data"
severity: "high"
cvss: 8.6
epss: 0.00341
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Outside In Technology", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["http-services", "oracle-fusion-middleware", "other", "outside-in-sdk"]
not_affected_if: ["not-on-8.5.8"]
published_at: "2026-10-20T22:20:36+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91343", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:55:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91343", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In: unauthenticated network flaw lets attacker alter critical data

Oracle Outside In Technology 8.5.8 (component Outside In Clean Content SDK) has an improper-authorization flaw (CWE-285 per VulDB) reachable by an unauthenticated attacker over HTTP. It allows unauthorized creation, deletion or modification of critical data (CVSS 3.1 8.6, vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Scope change means products that embed the SDK are also affected. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology affected 8.5.8 fixed ?

## How to check

Affected only if you run Outside In Technology 8.5.8, or an Oracle or third-party product that bundles the Outside In Clean Content SDK 8.5.8. Oracle's public pages give no install-version command. Check the SDK/library version in your product's install directory or release notes, or ask the vendor of the embedding product. Oracle customers can find it in MOS.

## Fix

Apply the Oct 2026 Critical Patch Update patch for Oracle Outside In Technology (Fusion Middleware patch availability document, MOS note, login required). The public advisory does not name a fixed version: unknown. A MOS login would settle it.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91343
- 2026-10-23T23:55:15+00:00 analyst — Oracle CPU Oct 2026 lists Outside In Technology 8.5.8 (Fusion Middleware); patch details are in the MOS patch availability document (login needed), so no fixed version number is published publicly. No exploitation or PoC found (Armis, VulDB). Did not search social posts; likely little discussion.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91343

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] CVE-2026-91343 Armis https://cve.armis.com/CVE-2026-91343

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_