{"id":"CVE-2026-91460","kind":"vulnerability","aliases":["CVE-2026-91460"],"related":[],"title":"Oracle Outside In: Image Export SDK flaw enables full takeover locally","description":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Outside In Technology's Image Export SDK component, version 8.5.8, has a flaw that lets an attacker who already has logon access to the host take over the product. Exploitation needs a person other than the attacker to take an action, such as opening a crafted file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","on-prem","oracle","outside-in","vendor"],"not_affected_if":["no-outside-in-installed"],"how_to_check":"- Check whether Oracle Outside In Technology `8.5.8` is installed on the host, for example through the Oracle Fusion Middleware installation directory\n- unknown for other checks; the sources do not give a file path or command","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-91460 for Oracle Outside In Technology `8.5.8`\n- unknown for exact patched version; the sources do not say","status":"open","published_at":"2026-10-20T22:20:49+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:35+00:00","updated_at":"2026-10-25T03:08:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:08:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-91460 for Oracle Outside In Technology `8.5.8`\n- unknown for exact patched version; the sources do not say","reach":"local","title":"Oracle Outside In: Image Export SDK flaw enables full takeover locally","impact":"high","summary":"Oracle Outside In Technology's Image Export SDK component, version 8.5.8, has a flaw that lets an attacker who already has logon access to the host take over the product. Exploitation needs a person other than the attacker to take an action, such as opening a crafted file.","category":"vendor","nicknames":[],"who_cares":["oracle","fusion-middleware","outside-in","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Outside In on the host, impacting confidentiality, integrity and availability","analyst_note":"Check the Oracle Critical Patch Update advisory for the patched version and affected file-processing paths; the NVD entry alone lacks fix and check details.","how_to_check":"- Check whether Oracle Outside In Technology `8.5.8` is installed on the host, for example through the Oracle Fusion Middleware installation directory\n- unknown for other checks; the sources do not give a file path or command","needs_analyst":true,"not_affected_if":["no-outside-in-installed"],"who_is_affected":"Systems running Oracle Outside In Technology version 8.5.8, specifically the Image Export SDK component, where an attacker has local logon. Teams that do not ship or run Oracle Fusion Middleware with Outside In can skip it. The sources do not say which applications embed the SDK.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3497,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91460':14A,17A '/av':166C '3.1':153C,165C '7.8':156C '8.5.8':39B,102C 'access':51B 'action':70B 'affect':100C 'allow':106C 'alreadi':48B 'attack':46B,66B,108C,127C,137C,139C 'avail':160C 'base':154C 'compon':37B,89C 'compromis':121C 'confidenti':157C 'craft':75B 'cve':12A,15A 'cvss':152C,162C,164C 'easili':103C 'enabl':8A 'execut':119C 'exploit':59B,104C 'export':5A,35B,93C 'file':76B 'flaw':7A,42B 'full':9A 'fusion':19B,87C 'fusion-middlewar':18B 'h':174C 'h/a':173C 'h/i':172C 'host':54B 'human':129C 'imag':4A,34B,92C 'impact':161C 'infrastructur':113C 'integr':158C 'interact':130C 'l/ac':167C 'l/pr':168C 'let':44B 'local':11A 'logon':50B,110C 'middlewar':20B,88C 'n/ui':169C 'need':60B 'on-prem':21B 'open':73B 'oracl':1A,24B,29B,80C,86C,115C,122C,148C 'outsid':2A,26B,30B,81C,90C,116C,123C,149C 'outside-in':25B 'person':62B,133C 'prem':23B 'product':58B,84C 'r/s':170C 'requir':128C 'result':144C 'score':155C 'sdk':6A,36B,94C 'success':126C,138C 'support':96C 'take':55B,68B 'takeov':10A,146C 'technolog':32B,83C,118C,125C,151C 'u/c':171C 'unauthent':107C 'vector':163C 'vendor':28B 'version':38B,97C 'vulner':77C,105C,142C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Outside In Technology version 8.5.8, specifically the Image Export SDK component, where an attacker has local logon. Teams that do not ship or run Oracle Fusion Middleware with Outside In can skip it. The sources do not say which applications embed the SDK.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91460","severity":null,"published_at":"2026-10-20T22:20:49+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}