Oracle Outside In Technology Faces Critical Remote Code Execution Flaw

Oracle has disclosed a critical security vulnerability in its Outside In Technology product, part of the Fusion Middleware suite. The flaw, identified as CVE-2026-91354, allows remote attackers to completely take over the affected system. According to the National Vulnerability Database, the issue is rated with a CVSS score of 9.9.

The vulnerability affects version 8.5.8 of the software. It is located within the Outside In Clean Content SDK component. An attacker with low privileges and network access via HTTP can exploit this weakness. The National Vulnerability Database states the vulnerability is easily exploitable. Successful exploitation results in a full takeover of the Oracle Outside In Technology instance.

Context and Background

The Common Vulnerability Scoring System version 3.1 assigns a base score of 9.9 to this flaw. This rating reflects high impacts on confidentiality, integrity, and availability. The CVSS vector indicates network-based attack vectors with low complexity. No user interaction is required for the attack to succeed. The source of the vulnerability is within the product itself, but the impact extends beyond it.

According to the NVD record, the scope changes during an attack. This means that while the vulnerability exists in Oracle Outside In Technology, successful attacks may significantly impact additional products. The vector string details are CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This confirms the remote nature and high severity of the threat.

Who Is Affected

Organizations running Oracle Fusion Middleware are potentially exposed to this risk. Specifically, those using version 8.5.8 of Oracle Outside In Technology are directly affected. The vulnerability impacts the Outside In Clean Content SDK component within this version. Any system allowing network access via HTTP to this component is at risk. Low-privileged attackers can leverage this access to compromise the system.

The scope change aspect is particularly concerning for enterprises. If an attacker compromises the Outside In Technology component, they may gain significant control over other integrated products. This expands the potential blast radius of the attack. Security teams must verify if they are running the affected version. The NVD record explicitly lists 8.5.8 as the supported version that is affected.

What should you do?

Security professionals should immediately audit their environments for Oracle Outside In Technology version 8.5.8. Identify any systems where the Outside In Clean Content SDK is exposed via HTTP. Monitor network traffic for unusual activity originating from or targeting these components. Since no fix has been confirmed yet in the source material, isolate affected systems if possible.

What to do and how to stay safe: Oracle

• Inventory all instances of Oracle Outside In Technology to confirm if version 8.5.8 is deployed.
• Restrict network access to the Outside In Clean Content SDK to trusted sources only.
• Monitor HTTP traffic logs for signs of exploitation attempts targeting the affected component.
• Prepare contingency plans for isolation once the vendor provides an update.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91354?

The National Vulnerability Database rates CVE-2026-91354 with a CVSS 3.1 Base Score of 9.9, which is classified as critical.

Which version of Oracle Outside In Technology is affected?

According to the NVD record, the supported version that is affected is 8.5.8.

Can an attacker exploit this vulnerability remotely?

Yes, the vulnerability allows a low privileged attacker with network access via HTTP to compromise the system.