---
id: "CVE-2026-91353"
kind: "vulnerability"
aliases: ["CVE-2026-91353"]
title: "Oracle Outside In Clean Content SDK: unauthenticated network flaw exposes data"
severity: "high"
cvss: 8.6
epss: 0.00398
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Outside In Technology", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["clean-content-sdk", "fusion-middleware", "oracle", "outside-in", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-outside-in-clean-content-sdk", "other-version"]
published_at: "2026-10-20T22:20:37+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91353", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:55:07+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91353", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In Clean Content SDK: unauthenticated network flaw exposes data

Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK component) has an easily exploitable flaw reachable by an unauthenticated attacker over HTTP. Impact is read access to critical or all Outside In accessible data, with scope change. Oracle rates it CVSS 3.1 8.6 (C:H, I:N, A:N): no code execution, no tampering, no DoS. Fixed in the October 2026 Critical Patch Update, but the public advisory gives no fixed version number.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology affected 8.5.8 fixed ?

## How to check

Find out whether you run Oracle Outside In Technology 8.5.8, standalone or bundled in an Oracle Fusion Middleware product, and whether the Clean Content SDK is reachable over HTTP. Outside In is not a standalone download, so check your Oracle product's patch level (for example OPatch lsinventory) against the October 2026 CPU.

## Fix

Apply the Oracle Critical Patch Update of October 20, 2026 for Fusion Middleware (Outside In Technology) via the patch availability document on My Oracle Support. The exact fixed Outside In version is unknown from public pages; the MOS document would settle it. Until patched, restrict network access to any HTTP service exposing the Clean Content SDK.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91353
- 2026-10-23T23:55:07+00:00 analyst — Oracle CPU Oct 20 2026 covers it (cpuoct2026 + cve.org record). Confidentiality only (C:H/I:N/A:N, scope changed): read access, no code execution or integrity/availability impact. No public fixed version number or named endpoint; patch doc is on My Oracle Support. No exploitation/PoC found; no social search done.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91353

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91353 https://www.cve.org/CVERecord?id=CVE-2026-91353

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_