{"id":"CVE-2026-91353","kind":"vulnerability","aliases":["CVE-2026-91353"],"related":[],"title":"Oracle Outside In Clean Content SDK: unauthenticated network flaw exposes data","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK component) has an easily exploitable flaw reachable by an unauthenticated attacker over HTTP. Impact is read access to critical or all Outside In accessible data, with scope change. Oracle rates it CVSS 3.1 8.6 (C:H, I:N, A:N): no code execution, no tampering, no DoS. Fixed in the October 2026 Critical Patch Update, but the public advisory gives no fixed version number.","severity":"high","cvss":8.6,"epss":0.00398,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["clean-content-sdk","fusion-middleware","oracle","outside-in","package","self-hosted"],"not_affected_if":["managed-hosting","no-outside-in-clean-content-sdk","other-version"],"how_to_check":"Find out whether you run Oracle Outside In Technology 8.5.8, standalone or bundled in an Oracle Fusion Middleware product, and whether the Clean Content SDK is reachable over HTTP. Outside In is not a standalone download, so check your Oracle product's patch level (for example OPatch lsinventory) against the October 2026 CPU.","fix":"Apply the Oracle Critical Patch Update of October 20, 2026 for Fusion Middleware (Outside In Technology) via the patch availability document on My Oracle Support. The exact fixed Outside In version is unknown from public pages; the MOS document would settle it. Until patched, restrict network access to any HTTP service exposing the Clean Content SDK.","status":"open","published_at":"2026-10-20T22:20:37+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:39:27+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:39:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Outside In Clean Content SDK: unauthenticated network flaw exposes data","impact":"high","summary":"Oracle Outside In Clean Content SDK 8.5.8 has a flaw that an unauthenticated attacker can reach over HTTP. A successful attack gives read access to critical data handled by Oracle Outside In.","category":"package","who_cares":["oracle","outside-in","fusion-middleware"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker reads critical data over HTTP","analyst_note":"Find Oracle's advisory and patched version for Outside In Clean Content SDK 8.5.8 and the affected HTTP endpoint, and confirm whether it is only read access or also code execution.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-outside-in-clean-content-sdk","other-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":3103,"output_tokens":369,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's advisory and patched version for Outside In Clean Content SDK 8.5.8 and the affected HTTP endpoint, and confirm whether it is only read access or also code execution.","search":"'-2026':13A,16A '-91353':14A,17A '/av':206C '2026':98B '3.1':79B,196C,205C '8.5.8':41B,136C '8.6':80B,199C 'access':63B,70B,145C,180C,186C,193C 'addit':167C 'advisori':105B 'affect':134C 'allow':140C 'attack':57B,142C,163C,172C 'base':197C 'c':81B 'c/c':211C 'chang':74B,170C 'clean':4A,23B,44B,126C 'clean-content-sdk':22B 'code':88B 'complet':185C 'compon':47B,123C 'compromis':149C 'confidenti':200C 'content':5A,24B,45B,127C 'critic':65B,99B,182C 'cve':12A,15A 'cvss':78B,195C,202C,204C 'data':11A,71B,183C,194C 'dos':93B 'easili':50B,137C 'execut':89B 'exploit':51B,138C 'expos':10A 'fix':94B,108B 'flaw':9A,52B 'fusion':27B,121C 'fusion-middlewar':26B 'give':106B 'h':82B 'h/i':212C 'host':36B 'http':59B,147C 'impact':60B,166C,201C 'in':20A 'l/pr':208C 'may':164C 'middlewar':28B,122C 'n':84B,86B,214C 'n/a':213C 'n/ac':207C 'n/s':210C 'n/ui':209C 'network':8A,144C 'number':110B 'octob':97B 'oracl':1A,29B,37B,75B,114C,120C,150C,159C,189C 'oracle':18A 'outsid':2A,31B,38B,42B,68B,115C,124C,151C,160C,190C 'outside':19A 'outside-in':30B 'packag':33B 'patch':100B 'product':118C,168C 'public':104B 'rate':76B 'reachabl':53B 'read':62B 'result':177C 'scope':73B,169C 'score':198C 'sdk':6A,25B,46B,128C 'self':35B 'self-host':34B 'signific':165C 'success':171C 'support':130C 'tamper':91B 'technolog':40B,117C,153C,162C,192C 'technology':21A 'unauthent':7A,56B,141C 'unauthor':179C 'updat':101B 'vector':203C 'version':109B,131C 'via':146C 'vulner':111C,139C,156C,175C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91353","severity":null,"published_at":"2026-10-20T22:20:37+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91353:547","url":null,"severity":null,"published_at":"2026-10-23T23:55:07+00:00","modified_at":"2026-10-23T23:55:07+00:00","first_seen_at":"2026-10-23T23:55:07+00:00","fetched_at":"2026-10-23T23:55:07+00:00","note":"Oracle CPU Oct 20 2026 covers it (cpuoct2026 + cve.org record). Confidentiality only (C:H/I:N/A:N, scope changed): read access, no code execution or integrity/availability impact. No public fixed version number or named endpoint; patch doc is on My Oracle Support. No exploitation/PoC found; no social search done."},{"source":"epss","external_id":"CVE-2026-91353","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91353","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2235,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91353","title":"CVE Record: CVE-2026-91353","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}