Oracle Outside In Technology: Information disclosure in Clean Content SDK
Summary
Oracle Outside In Technology, a component of Oracle Fusion Middleware (Outside In Clean Content SDK), contains a vulnerability in version 8.5.8. An unauthenticated attacker with network access via HTTP can exploit it with low complexity and no user interaction. Successful attacks can lead to unauthorized access to sensitive data, with a scope change affecting other products that use the component.
Affected
- Oracle Outside In Technology 8.5.8 (Clean Content SDK component)
Fixed in
- Fixed in the Oracle October 2026 Critical Patch Update (reported by OffSeq; not verified against the Oracle advisory)
- Fixed build number: Unknown. Check the Oracle advisory.
Workaround
- Unknown. The CVE record and NVD provide no workaround.
- Restrict network access to HTTP services that use Outside In until the patch is applied.
- Oracle advises uninstalling or disabling the Clean Content SDK if not needed. This is stated for sibling CVE-2026-91354 and is not confirmed for this CVE.
Exploitation
- CISA KEV: not listed.
- No known in-the-wild exploitation.
- No public proof-of-concept found; not fully verified.
- EPSS below 1%.
Our recommendation
- Check whether Oracle Fusion Middleware or products bundling Outside In 8.5.8 are in use, especially if internet-facing or partner-facing.
- Apply the October 2026 Oracle Critical Patch Update, after confirming the fixed Outside In build in the Oracle advisory.
- Restrict HTTP access to affected services until patched.
- Monitor for unusual access to these services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert CPU October 2026 www.oracle.com
- OpenCVE CVE-2026-91353 app.opencve.io
- Vulners CVE-2026-91353 vulners.com
- OffSeq Radar CVE-2026-91353 radar.offseq.com
- Oracle Blog: October 2026 CPU now available blogs.oracle.com
- Waratek: Oracle October 2026 CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:26.
Original description (NVD)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.