{"id":"CVE-2026-91459","kind":"vulnerability","aliases":["CVE-2026-91459"],"related":[],"title":"Oracle Outside In: image export SDK flaw lets local attacker take over","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Outside In Technology's Image Export SDK contains a flaw that lets an attacker who can log on to the host take over the component. The attack needs a person other than the attacker to take an action, and the CVSS score is 7.8 with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","on-premise","oracle-outside-in","other"],"not_affected_if":["other-versions"],"how_to_check":"- Confirm whether the Oracle Outside In Image Export SDK is installed and at version `8.5.8`, the affected version named in the sources","fix":null,"status":"open","published_at":"2026-10-20T22:20:49+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:43+00:00","updated_at":"2026-10-25T03:08:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:08:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Oracle Outside In: image export SDK flaw lets local attacker take over","impact":"high","summary":"Oracle Outside In Technology's Image Export SDK contains a flaw that lets an attacker who can log on to the host take over the component. The attack needs a person other than the attacker to take an action, and the CVSS score is 7.8 with high impact to confidentiality, integrity and availability.","category":"other","nicknames":[],"who_cares":["oracle-outside-in","fusion-middleware","on-premise"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker takes over the Outside In component and its host data","analyst_note":"","how_to_check":"- Confirm whether the Oracle Outside In Image Export SDK is installed and at version `8.5.8`, the affected version named in the sources","needs_analyst":false,"not_affected_if":["other-versions"],"who_is_affected":"Teams that run or ship Oracle Outside In Technology version 8.5.8 with the Image Export SDK component. Exposure needs an attacker with logon to the infrastructure where the SDK runs, and a person other than the attacker must act for the attack to succeed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001111,"input_tokens":3497,"output_tokens":1522,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91459':14A,17A '/av':169C '3.1':156C,168C '7.8':71B,159C '8.5.8':105C 'action':65B 'affect':103C 'allow':109C 'attack':10A,41B,54B,61B,111C,130C,140C,142C 'avail':79B,163C 'base':157C 'compon':52B,92C 'compromis':124C 'confidenti':76B,160C 'contain':35B 'cve':12A,15A 'cvss':68B,155C,165C,167C 'easili':106C 'execut':122C 'exploit':107C 'export':5A,33B,96C 'flaw':7A,37B 'fusion':19B,90C 'fusion-middlewar':18B 'h':177C 'h/a':176C 'h/i':175C 'high':73B 'host':48B 'human':132C 'imag':4A,32B,95C 'impact':74B,164C 'infrastructur':116C 'integr':77B,161C 'interact':133C 'l/ac':170C 'l/pr':171C 'let':8A,39B 'local':9A 'log':44B 'logon':113C 'middlewar':20B,91C 'n/ui':172C 'need':55B 'on-premis':21B 'oracl':1A,25B,27B,83C,89C,118C,125C,151C 'oracle-outside-in':24B 'outsid':2A,26B,28B,84C,93C,119C,126C,152C 'person':57B,136C 'premis':23B 'product':87C 'r/s':173C 'requir':131C 'result':147C 'score':69B,158C 'sdk':6A,34B,97C 'success':129C,141C 'support':99C 'take':11A,49B,63B 'takeov':149C 'technolog':30B,86C,121C,128C,154C 'u/c':174C 'unauthent':110C 'vector':166C 'version':100C 'vulner':80C,108C,145C","nicknames":[],"mitigations":[],"who_affected":"Teams that run or ship Oracle Outside In Technology version 8.5.8 with the Image Export SDK component. Exposure needs an attacker with logon to the infrastructure where the SDK runs, and a person other than the attacker must act for the attack to succeed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91459","severity":null,"published_at":"2026-10-20T22:20:49+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}