EUVD-2026-61383
GHSA-3xmj-w8h4-2f83
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector and no-privilege requirement align with Oracle description; human interaction dependency confirmed; full C/I/A impact consistent with reported takeover outcome.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover via Oracle Outside In Technology 8.5.8 is achievable by a local attacker exploiting a flaw in the PDF Export SDK component, requiring no application-level privileges but depending on human interaction from another user on the same infrastructure. The attack vector is strictly local (AV:L), confining risk to hosts where the SDK executes, yet successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected process and host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have local logon access to the host infrastructure where Oracle Outside In Technology 8.5.8 executes - network-only access is excluded by AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 reflects a high-impact but locally-constrained finding - AV:L limits the attacker pool to those already holding infrastructure logon access, and UI:R introduces a dependency on triggering action from a second, legitimate user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with logon credentials to the server hosting Oracle Outside In Technology 8.5.8 crafts a malicious document designed to trigger a flaw in the PDF Export SDK during output generation. The attacker positions this file such that a legitimate user - an administrator, a scheduled job acting on user behalf, or an operator processing documents - opens or submits it through the SDK. … |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, which remediates this vulnerability in Outside In Technology 8.5.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems running Oracle Outside In Technology 8.5.8 and assess the scope of local user access to those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today