{"id":"CVE-2026-91354","kind":"vulnerability","aliases":["CVE-2026-91354"],"related":[],"title":"Oracle Outside In: flaw lets low-privilege network attacker take over","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Outside In is a content-extraction SDK shipped in Oracle Fusion Middleware. A low-privileged attacker reaching it over HTTP can take over the component, and the scope change means other products can be hit too.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Outside In Technology (Clean Content SDK)","fixed":[],"affected":"8.5.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-fusion-middleware","other","outside-in","self-hosted"],"not_affected_if":["not-using-outside-in"],"how_to_check":"Find where Oracle Outside In Technology (Clean Content SDK) is installed, usually bundled in Oracle Fusion Middleware or in products that embed the SDK. Check the version. 8.5.8 is affected. Also check whether the SDK is reachable over HTTP by low-privileged users.","fix":"Apply the Oracle October 2026 Critical Patch Update for Outside In Technology via the Fusion Middleware patch availability document on My Oracle Support. The exact fixed version is unknown from public pages; the MOS document would settle it. Until patched, limit HTTP access to the SDK endpoint to trusted users with network ACLs or a reverse proxy.","status":"open","published_at":"2026-10-20T22:20:38+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:02+00:00","updated_at":"2026-10-23T22:57:15+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:34:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Outside In: flaw lets low-privilege network attacker take over","impact":"high","summary":"Oracle Outside In is a content-extraction SDK shipped in Oracle Fusion Middleware. A low-privileged attacker reaching it over HTTP can take over the component, and the scope change means other products can be hit too.","category":"other","who_cares":["oracle-fusion-middleware","outside-in","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the component and reaches other connected products","analyst_note":"Find the Oracle Critical Patch Update fix and patched version for Outside In Clean Content SDK 8.5.8 at https://nvd.nist.gov/vuln/detail/CVE-2026-91354.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-using-outside-in"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000869,"input_tokens":3121,"output_tokens":1114,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update fix and patched version for Outside In Clean Content SDK 8.5.8 at https://nvd.nist.gov/vuln/detail/CVE-2026-91354.","search":"'-2026':13A,16A '-91354':14A,17A '/av':164C '3.1':151C,163C '8.5.8':100C '9.9':154C 'access':110C 'addit':132C 'affect':98C 'allow':104C 'attack':10A,55B,107C,128C,137C 'avail':158C 'base':152C 'c/c':169C 'chang':68B,135C 'clean':22A,90C 'compon':64B,87C 'compromis':114C 'confidenti':155C 'content':23A,43B,91C 'content-extract':42B 'cve':12A,15A 'cvss':150C,160C,162C 'easili':101C 'exploit':102C 'extract':44B 'flaw':4A 'fusion':28B,49B,85C 'h':172C 'h/a':171C 'h/i':170C 'hit':74B 'host':36B 'http':59B,112C 'impact':131C,159C 'in':20A 'integr':156C 'l/pr':166C 'l/ui':167C 'let':5A 'low':7A,53B,105C 'low-privileg':6A,52B 'may':129C 'mean':69B 'middlewar':29B,50B,86C 'n/ac':165C 'n/s':168C 'network':9A,109C 'oracl':1A,25B,27B,37B,48B,78C,84C,115C,124C,146C 'oracle':18A 'oracle-fusion-middlewar':26B 'outsid':2A,32B,38B,79C,88C,116C,125C,147C 'outside':19A 'outside-in':31B 'privileg':8A,54B,106C 'product':71B,82C,133C 'reach':56B 'result':142C 'scope':67B,134C 'score':153C 'sdk':24A,45B,92C 'self':35B 'self-host':34B 'ship':46B 'signific':130C 'success':136C 'support':94C 'take':11A,61B 'takeov':144C 'technolog':81C,118C,127C,149C 'technology':21A 'vector':161C 'version':95C 'via':111C 'vulner':75C,103C,121C,140C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91354","severity":null,"published_at":"2026-10-20T22:20:38+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91354:334","url":null,"severity":null,"published_at":"2026-10-23T22:57:15+00:00","modified_at":"2026-10-23T22:57:15+00:00","first_seen_at":"2026-10-23T22:57:15+00:00","fetched_at":"2026-10-23T22:57:15+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists Outside In Technology 8.5.8 under Fusion Middleware; fixed version number is not public, patch is behind My Oracle Support. Armis says the patched release supersedes 8.5.8. No exploitation or PoC found; social search not done."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1695,"url":"https://cve.armis.com/CVE-2026-91354","title":"Armis: CVE-2026-91354","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}