---
id: "CVE-2026-91354"
kind: "vulnerability"
aliases: ["CVE-2026-91354"]
title: "Oracle Outside In: flaw lets low-privilege network attacker take over"
severity: "critical"
cvss: 9.9
epss: 0.00328
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Outside In Technology (Clean Content SDK)", "fixed": [], "affected": "8.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle", "oracle-fusion-middleware", "other", "outside-in", "self-hosted"]
not_affected_if: ["not-using-outside-in"]
published_at: "2026-10-20T22:20:38+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91354", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:57:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91354", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In: flaw lets low-privilege network attacker take over

Oracle Outside In is a content-extraction SDK shipped in Oracle Fusion Middleware. A low-privileged attacker reaching it over HTTP can take over the component, and the scope change means other products can be hit too.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Outside In Technology (Clean Content SDK) affected 8.5.8 fixed ?

## How to check

Find where Oracle Outside In Technology (Clean Content SDK) is installed, usually bundled in Oracle Fusion Middleware or in products that embed the SDK. Check the version. 8.5.8 is affected. Also check whether the SDK is reachable over HTTP by low-privileged users.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Outside In Technology via the Fusion Middleware patch availability document on My Oracle Support. The exact fixed version is unknown from public pages; the MOS document would settle it. Until patched, limit HTTP access to the SDK endpoint to trusted users with network ACLs or a reverse proxy.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91354
- 2026-10-23T22:57:15+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists Outside In Technology 8.5.8 under Fusion Middleware; fixed version number is not public, patch is behind My Oracle Support. Armis says the patched release supersedes 8.5.8. No exploitation or PoC found; social search not done.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91354

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mitigation] Armis: CVE-2026-91354 https://cve.armis.com/CVE-2026-91354

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_