{"id":"CVE-2026-91352","kind":"vulnerability","aliases":["CVE-2026-91352"],"related":[],"title":"Oracle Outside In Clean Content SDK: unauthenticated HTTP request causes partial denial of service","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"Oracle Outside In Clean Content SDK 8.5.8 has a flaw that an unauthenticated attacker can trigger over the network via HTTP. The result is a partial denial of service, with no confidentiality or integrity loss.","severity":"medium","cvss":5.3,"epss":0.00293,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","oracle","outside-in","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:37+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:22:47+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:22:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Outside In Clean Content SDK: unauthenticated HTTP request causes partial denial of service","impact":"low","summary":"Oracle Outside In Clean Content SDK 8.5.8 has a flaw that an unauthenticated attacker can trigger over the network via HTTP. The result is a partial denial of service, with no confidentiality or integrity loss.","category":"package","nicknames":[],"who_cares":["oracle","fusion-middleware","outside-in"],"confidence":0.6,"needs_auth":"no","worst_case":"Partial denial of service of the Outside In component","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and whether the SDK is exposed in default deployments; the NVD entry does not name a patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000529,"input_tokens":3472,"output_tokens":363,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91352':17A,20A '/av':142C '3.1':132C,141C '5.3':135C '8.5.8':35B,89C 'abil':116C 'access':98C 'affect':87C 'allow':93C 'attack':42B,95C,108C 'avail':136C 'base':133C 'caus':10A,118C 'clean':4A,32B,79C 'compon':76C 'compromis':102C 'confidenti':60B 'content':5A,33B,80C 'cve':15A,18A 'cvss':131C,138C,140C 'denial':12A,55B,121C 'dos':125C 'easili':90C 'exploit':91C 'flaw':38B 'fusion':22B,74C 'fusion-middlewar':21B 'http':8A,49B,100C 'impact':137C 'integr':62B 'l':150C 'l/pr':144C 'loss':63B 'middlewar':23B,75C 'n/a':149C 'n/ac':143C 'n/i':148C 'n/s':146C 'n/ui':145C 'network':47B,97C 'oracl':1A,24B,29B,67C,73C,103C,127C 'outsid':2A,26B,30B,68C,77C,104C,128C 'outside-in':25B 'packag':28B 'partial':11A,54B,120C,124C 'product':71C 'request':9A 'result':51B,113C 'score':134C 'sdk':6A,34B,81C 'servic':14A,57B,123C 'success':107C 'support':83C 'technolog':70C,106C,130C 'trigger':44B 'u/c':147C 'unauthent':7A,41B,94C 'unauthor':115C 'vector':139C 'version':84C 'via':48B,99C 'vulner':64C,92C,111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91352","severity":null,"published_at":"2026-10-20T22:20:37+00:00","modified_at":"2026-10-22T19:18:04+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91352","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91352","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}