CVE-2026-91405
HighCVSS 7.5Summary
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
Risk Assessment
Although difficult to exploit, a successful attack can result in full system takeover, posing high risk to confidentiality, integrity, and availability of data.
Recommendation
Update Oracle Outside In Technology to the latest patched version and limit user interaction with untrusted PDF files.
Other vulnerabilities in Oracle Outside In Technology
See all- CVE-2026-91483High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91460High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91459High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91458High
Vulnerability in Oracle Outside In Technology (Outside In Core component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91457High
Vulnerability in Oracle Outside In Technology (Outside In Image Export SDK component) version 8.5.8. An authenticated attacker with local access and user interaction can take over the product. CVSS 7.8.
- CVE-2026-91406High
Vulnerability in Oracle Outside In Technology (component Outside In PDF Export SDK) version 8.5.8. A difficult-to-exploit attack via HTTP network access requires user interaction and can lead to takeover of the product.
- CVE-2026-91355High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the product.
- CVE-2026-91353High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to gain unauthorized access to critical data, with potential impact on other products.
- CVE-2026-91350High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91349High
Vulnerability in Oracle Outside In Technology (component Outside In Clean Content SDK) version 8.5.8. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to cause a hang or frequently repeatable crash (complete DoS).
Original NVD description (English source)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS