---
id: "CVE-2026-91460"
kind: "vulnerability"
aliases: ["CVE-2026-91460"]
title: "Oracle Outside In: Image Export SDK flaw enables full takeover locally"
severity: "high"
cvss: 7.8
epss: 0.00288
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["fusion-middleware", "on-prem", "oracle", "outside-in", "vendor"]
not_affected_if: ["no-outside-in-installed"]
published_at: "2026-10-20T22:20:49+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91460", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91460", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Outside In: Image Export SDK flaw enables full takeover locally

Oracle Outside In Technology's Image Export SDK component, version 8.5.8, has a flaw that lets an attacker who already has logon access to the host take over the product. Exploitation needs a person other than the attacker to take an action, such as opening a crafted file.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether Oracle Outside In Technology `8.5.8` is installed on the host, for example through the Oracle Fusion Middleware installation directory
- unknown for other checks; the sources do not give a file path or command

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-91460 for Oracle Outside In Technology `8.5.8`
- unknown for exact patched version; the sources do not say

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91460
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91460

## From the sources

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_