Oracle Outside In Technology: Unauthenticated data modification and denial of service over HTTP

Summary

Oracle Outside In Technology version 8.5.8, component Outside In Clean Content SDK, is affected by a vulnerability that can be exploited remotely over HTTP without authentication or user interaction. A successful attacker could modify critical data accessible to the component and cause a hang or repeatable crash (denial of service). The NVD assigns a CVSS 3.1 base score of 9.1 (Critical); code execution is not described in the CVE record. Exposure depends on whether an Outside In-based service is reachable from untrusted networks.

Affected

• Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK component, Oracle Fusion Middleware)
• CVSS 3.1: 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Fixed in

Unknown. Check the Oracle October 2026 Critical Patch Update advisory for the fixed version.

Workaround

• Unknown. No vendor-confirmed workaround for this CVE.
• Restrict external HTTP access to affected services at the firewall.
• Disable the Outside In Clean Content SDK if it is not required.

Exploitation

• Exploited in the wild: none known as of the sources reviewed.
• Not listed in CISA KEV at the time of the sources reviewed.
• Public proof of concept: none found; not exhaustively checked.
• CISA SSVC: Automatable yes, technical impact partial.

Our recommendation

• Identify systems that use Oracle Outside In, for example by searching asset inventories for "Outside In" or Fusion Middleware.
• Apply the Oracle October 2026 Critical Patch Update fix for Outside In 8.5.8 as a priority once the fixed version is confirmed in the advisory.
• Until patched, block unnecessary external HTTP access to affected services and disable the component if unused.
• Monitor affected services for crashes, hangs and unexpected data changes.
• Re-check the NVD entry for revised CVSS data, as it was still under analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
• OpenCVE: CVE-2026-91341 app.opencve.io
• Vulners: CVE-2026-91341 vulners.com
• Breach Signal: Oracle October 2026 CPU breach-signal.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:43.