CVE-2026-91354
CriticalCVSS 9.9Summary
Vulnerability in Oracle Outside In Technology (Outside In Clean Content SDK component) version 8.5.8. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over the product, and attacks may significantly impact additional products (scope change).
Risk Assessment
Potential full takeover of Oracle Outside In Technology by a low-privileged attacker, leading to confidentiality, integrity and availability impacts and affecting related systems.
Recommendation
Update Oracle Outside In Technology to a patched version and restrict network access to the component to trusted sources.
Other vulnerabilities in Oracle Outside In Technology
See all- CVE-2026-91483High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91460High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91459High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91458High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91457High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91406High
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
- CVE-2026-91405High
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
- CVE-2026-91355High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the product.
- CVE-2026-91353High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to gain unauthorized access to critical data, with potential impact on other products.
- CVE-2026-91350High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to cause a hang or frequently repeatable crash (complete DoS).
Original NVD description (English source)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology. While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS