---
id: "CVE-2026-91459"
kind: "vulnerability"
aliases: ["CVE-2026-91459"]
title: "Oracle Outside In: image export SDK flaw lets local attacker take over"
severity: "high"
cvss: 7.8
epss: 0.00288
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fusion-middleware", "on-premise", "oracle-outside-in", "other"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:20:49+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91459", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91459", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In: image export SDK flaw lets local attacker take over

Oracle Outside In Technology's Image Export SDK contains a flaw that lets an attacker who can log on to the host take over the component. The attack needs a person other than the attacker to take an action, and the CVSS score is 7.8 with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the Oracle Outside In Image Export SDK is installed and at version `8.5.8`, the affected version named in the sources

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91459
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91459

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_