CVE-2026-91355
HighCVSS 8.4Summary
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the product.
Risk Assessment
An attacker with local access can take over the system, posing high risk to confidentiality, integrity, and availability.
Recommendation
Update Oracle Outside In Technology to the latest patched version and restrict local access to the infrastructure.
Other vulnerabilities in Oracle Outside In Technology
See all- CVE-2026-91483High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91460High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91459High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91458High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91457High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91406High
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
- CVE-2026-91405High
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
- CVE-2026-91353High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to gain unauthorized access to critical data, with potential impact on other products.
- CVE-2026-91350High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91349High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to cause a hang or frequently repeatable crash (complete DoS).
Original NVD description (English source)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS