{"id":"CVE-2026-91346","kind":"vulnerability","aliases":["CVE-2026-91346"],"related":[],"title":"Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw exposes data","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","summary":"Oracle Outside In Clean Content SDK 8.5.8 contains a flaw that a remote, unauthenticated attacker can reach over HTTP. A successful attack needs a person other than the attacker to take an action and can read critical data and change some data in connected products.","severity":"high","cvss":8.2,"epss":0.00228,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology (Clean Content SDK)","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["clean-content-sdk","fusion-middleware","oracle","outside-in","self-hosted","vendor"],"not_affected_if":["clean-content-sdk-not-used","outside-in-not-installed","unknown"],"how_to_check":"Find where Outside In Technology is installed (standalone or embedded in Fusion Middleware products) and check whether the Clean Content SDK is version 8.5.8, then compare against the patch listed in the Oracle CPU October 2026 patch availability document.","fix":"Apply the Oracle October 2026 Critical Patch Update for Outside In Technology via My Oracle Support (patch Doc ID not read; fixed version unknown). No workaround is documented in the sources I read.","status":"open","published_at":"2026-10-20T22:20:37+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:03:59+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:03:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw exposes data","impact":"high","summary":"Oracle Outside In Clean Content SDK 8.5.8 contains a flaw that a remote, unauthenticated attacker can reach over HTTP. A successful attack needs a person other than the attacker to take an action and can read critical data and change some data in connected products.","category":"vendor","nicknames":[],"who_cares":["oracle","fusion-middleware","outside-in"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthorized read of critical data and some unauthorized data changes","analyst_note":"Find Oracle's security alert and patch list for Outside In 8.5.8 and the affected products, since the NVD text names no fixed version or workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle Fusion Middleware with the Outside In Clean Content SDK at version 8.5.8 that accepts HTTP input from outside. The sources do not say which products embed the SDK or which configurations are exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000583,"input_tokens":3569,"output_tokens":452,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's security alert and patch list for Outside In 8.5.8 and the affected products, since the NVD text names no fixed version or workaround.","search":"'-2026':13A,16A '-91346':14A,17A '/av':213C '3.1':201C,212C '8.2':204C '8.5.8':46B,110C 'access':119C,167C,173C,180C,190C,198C 'action':72B 'addit':154C 'affect':108C 'allow':114C 'attack':54B,61B,68B,116C,129C,139C,150C,159C 'base':202C 'c/c':218C 'chang':79B,157C 'clean':4A,22A,26B,43B,100C 'clean-content-sdk':25B 'complet':172C 'compon':97C 'compromis':123C 'confidenti':205C 'connect':83B 'contain':47B 'content':5A,23A,27B,44B,101C 'critic':76B,169C 'cve':12A,15A 'cvss':200C,209C,211C 'data':11A,77B,81B,170C,181C,199C 'delet':189C 'easili':111C 'exploit':112C 'expos':10A 'flaw':9A,49B 'fusion':30B,95C 'fusion-middlewar':29B 'h/i':219C 'host':38B 'http':8A,58B,121C 'human':131C 'impact':153C,208C 'in':20A 'insert':187C 'integr':207C 'interact':132C 'l/a':220C 'l/pr':215C 'may':151C 'middlewar':31B,96C 'n':221C 'n/ac':214C 'n/ui':216C 'need':62B 'network':118C 'oracl':1A,32B,40B,88C,94C,124C,146C,176C,194C 'oracle':18A 'outsid':2A,34B,41B,89C,98C,125C,147C,177C,195C 'outside':19A 'outside-in':33B 'person':64B,135C 'product':84B,92C,155C 'r/s':217C 'reach':56B 'read':75B 'remot':52B 'requir':130C 'result':164C 'scope':156C 'score':203C 'sdk':6A,24A,28B,45B,102C 'self':37B 'self-host':36B 'signific':152C 'success':60B,128C,158C 'support':104C 'take':70B 'technolog':91C,127C,149C,179C,197C 'technology':21A 'unauthent':7A,53B,115C 'unauthor':166C,185C 'updat':186C 'vector':210C 'vendor':39B 'version':105C 'via':120C 'vulner':85C,113C,143C,162C 'well':183C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Outside In Technology 8.5.8 with the Clean Content SDK, directly or embedded in Oracle Fusion Middleware products, that process documents or requests received over HTTP. Exploitation needs a user to interact with a malicious file or request. Teams that do not use Outside In or the Clean Content SDK can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91346","severity":null,"published_at":"2026-10-20T22:20:37+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91346:712","url":null,"severity":null,"published_at":"2026-10-25T03:25:03+00:00","modified_at":"2026-10-25T03:25:03+00:00","first_seen_at":"2026-10-25T03:25:03+00:00","fetched_at":"2026-10-25T03:25:03+00:00","note":"Oracle's October 2026 CPU (20 Oct 2026) is the primary advisory. CVE record lists only 8.5.8 affected. I could not read the Outside In risk matrix or patch Doc ID (page too large for my tools), so the fixed version is unknown. Oracle's public downloads page lists no version newer than 8.5.8. Patch is delivered via the CPU through My Oracle Support. No exploitation or PoC found in any source. Siblings CVE-2026-91342/91345/91353/91354 hit the same component, some rated critical."},{"source":"epss","external_id":"CVE-2026-91346","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91346","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3160,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91346","title":"CVE Record: CVE-2026-91346","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3161,"url":"https://www.oracle.com/middleware/technologies/outside-in-technology-downloads.html","title":"Oracle Outside In Technology Downloads","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}