Oracle Outside In Technology: Privilege escalation in Clean Content SDK
Summary
Oracle Outside In Technology 8.5.8, a component of Oracle Fusion Middleware (Outside In Clean Content SDK), contains a vulnerability that allows an attacker with a logon to the host running the SDK to compromise the component. The CVSS base score is 8.4 (High) with high impact on confidentiality, integrity and availability. The CNA's description states that a successful attack can result in takeover of the component; the CWE classification is still being verified. Exposure is likely limited for most SMEs, as the SDK is usually embedded in other software.
Affected
- Oracle Outside In Technology, version 8.5.8 (Clean Content SDK component)
Fixed in
- Unknown. Check the Oracle Critical Patch Update of October 2026 (latest revision) for the patch for Outside In Technology.
Workaround
- No workaround documented by the vendor.
- Restrict which accounts can log on to hosts running the SDK.
- Remove the SDK from systems where it is not needed.
Exploitation
- Not listed in CISA KEV.
- No reports of exploitation in the wild found.
- No public proof of concept found; this does not prove that none exists.
- CISA SSVC: Exploitation none, not automatable, total technical impact.
Our recommendation
- Identify which installed software embeds Outside In 8.5.8.
- Apply the fixed version from Oracle's October 2026 Critical Patch Update as soon as it is confirmed for your product.
- Prioritise shared servers, document-processing and integration hosts.
- Restrict local logons on affected hosts and monitor them.
- Patch the whole product, as other CVEs from the same batch affect it too.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert Advisory October 2026 CPU www.oracle.com
- OpenCVE CVE-2026-91355 app.opencve.io
- Strix CVE-2026-91355 www.strix.ai
- Vulners Oracle CPU October 2026 vulners.com
- Oracle Security Alerts index www.oracle.com
- Oracle public vulnerability to advisory mapping www.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:13.
Original description (NVD)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.