Oracle Outside In Technology: Improper input validation in Outside In Core
Summary
Oracle Outside In Technology version 8.5.8, specifically its Outside In Core component, contains a vulnerability (CWE-20, improper input validation). An attacker who already has logon to the system where Outside In runs can compromise the library, with a CVSS 3.1 base score of 7.8. Exploitation requires a user other than the attacker to take an action, such as opening a crafted file. The flaw is not remotely exploitable from the internet.
Affected
- Oracle Outside In Technology 8.5.8 (supported version)
Fixed in
- Unknown. Apply the patch from Oracle's October 2026 Critical Patch Update; the exact patch identifier is not confirmed in the sources.
Workaround
- Unknown. No vendor workaround found.
- Interim measure (not a vendor statement): limit which files reach affected Outside In-based components and restrict local logons on those hosts.
Exploitation
- CISA SSVC data: exploitation none, automatable no, total technical impact.
- Not found in CISA KEV at the time of research.
- No public proof of concept found; absence of evidence is not proof.
Our recommendation
- Identify every host and application that bundles Outside In 8.5.8, such as document viewers, converters or archiving/ECM tools.
- Apply the October 2026 Oracle CPU patch for these components, together with the other CVEs in the same batch (e.g. CVE-2026-91483).
- Until patched, restrict local logons on affected hosts and limit untrusted files processed by them.
- Re-check NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD entry (via OpenCVE mirror) app.opencve.io
- Vulners CVE-2026-91458 vulners.com
- Strix CVE-2026-91458 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:14.
Original description (NVD)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.