Oracle Outside In Technology: Improper access control in Clean Content SDK
Summary
Oracle Outside In Technology 8.5.8, specifically the Clean Content SDK component, contains an improper access control flaw (CWE-284). An unauthenticated attacker with network access via HTTP can exploit it if a user interacts with a crafted request or file, and can create, modify or delete critical data and read a subset of accessible data, with a scope change affecting other products. Exploitation requires user interaction and the SDK is usually embedded in other software, so exposure depends on whether an HTTP service processes files through it.
Affected
- Oracle Outside In Technology 8.5.8 (Clean Content SDK component)
- Other versions: not stated in the sources.
Fixed in
- Fixed version: Unknown. Sources indicate a security patch in the Oracle Critical Patch Update of October 2026 for 8.5.8; the exact patch identifier was not confirmed.
Workaround
- Unknown. No vendor workaround found.
- Until patched, restrict HTTP endpoints that process files through the Outside In component to internal or trusted networks and require authentication where possible.
Exploitation
- No known exploitation in the wild as of the sources.
- No public proof-of-concept code found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Inventory whether any system runs Outside In 8.5.8 directly or through an embedded product.
- Confirm the fix in the Oracle October 2026 CPU advisory and apply it to 8.5.8.
- Prioritise patching if the affected HTTP endpoint is internet-facing, or restrict access until patched.
- Recheck NVD (analysis pending) and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- OpenCVE CVE-2026-91342 app.opencve.io
- Strix CVE-2026-91342 www.strix.ai
- Oracle Outside In Technology Downloads www.oracle.com
- Waratek: October 2026 Oracle CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:26.
Original description (NVD)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.