---
id: "CVE-2026-91346"
kind: "vulnerability"
aliases: ["CVE-2026-91346"]
title: "Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw exposes data"
severity: "high"
cvss: 8.2
epss: 0.00228
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Outside In Technology (Clean Content SDK)", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["clean-content-sdk", "fusion-middleware", "oracle", "outside-in", "self-hosted", "vendor"]
not_affected_if: ["clean-content-sdk-not-used", "outside-in-not-installed", "unknown"]
published_at: "2026-10-20T22:20:37+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91346", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:25:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91346", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw exposes data

Oracle Outside In Clean Content SDK 8.5.8 contains a flaw that a remote, unauthenticated attacker can reach over HTTP. A successful attack needs a person other than the attacker to take an action and can read critical data and change some data in connected products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology (Clean Content SDK) affected 8.5.8 fixed ?

## How to check

Find where Outside In Technology is installed (standalone or embedded in Fusion Middleware products) and check whether the Clean Content SDK is version 8.5.8, then compare against the patch listed in the Oracle CPU October 2026 patch availability document.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Outside In Technology via My Oracle Support (patch Doc ID not read; fixed version unknown). No workaround is documented in the sources I read.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91346
- 2026-10-25T03:25:03+00:00 analyst — Oracle's October 2026 CPU (20 Oct 2026) is the primary advisory. CVE record lists only 8.5.8 affected. I could not read the Outside In risk matrix or patch Doc ID (page too large for my tools), so the fixed version is unknown. Oracle's public downloads page lists no version newer than 8.5.8. Patch is delivered via the CPU through My Oracle Support. No exploitation or PoC found in any source. Siblings CVE-2026-91342/91345/91353/91354 hit the same component, some rated critical.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91346

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91346 https://www.cve.org/CVERecord?id=CVE-2026-91346
- [mentions] Oracle Outside In Technology Downloads https://www.oracle.com/middleware/technologies/outside-in-technology-downloads.html

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_