Live › vulnerability › CVE-2026-91346
Go to dashboardOracle Outside In Clean Content SDK 8.5.8 contains a flaw that a remote, unauthenticated attacker can reach over HTTP. A successful attack needs a person other than the attacker to take an action and can read critical data and change some data in connected products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle Outside In Technology 8.5.8 with the Clean Content SDK, directly or embedded in Oracle Fusion Middleware products, that process documents or requests received over HTTP. Exploitation needs a user to interact with a malicious file or request. Teams that do not use Outside In or the Clean Content SDK can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle Outside In Technology (Clean Content SDK) | vendor | 8.5.8 | – |
Find where Outside In Technology is installed (standalone or embedded in Fusion Middleware products) and check whether the Clean Content SDK is version 8.5.8, then compare against the patch listed in the Oracle CPU October 2026 patch availability document.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91346")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.