What is the CVSS score of CVE-2026-60392?

CVE-2026-60392 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Outside In Technology are affected by CVE-2026-60392?

Oracle Outside In Technology 8.5.8 contains a critical vulnerability in the PDF Export SDK that allows any local system user to achieve complete system takeover without special privileges.

How to fix or mitigate CVE-2026-60392?

Within 24 hours, conduct an inventory of all systems running Oracle Outside In Technology 8.5.8 and assess the scope of local user access to those systems. Within 7 days, apply the Oracle August 2026 Critical Patch Update to all identified affected systems. Within 30 days, complete validation testing of the patched systems and document remediation compliance across the organization.

Outside In Technology CVE-2026-60392

EUVD-2026-61383 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-18 secalert_us@oracle.com

GHSA-3xmj-w8h4-2f83

Deserialization Oracle Outside In Technology

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and no-privilege requirement align with Oracle description; human interaction dependency confirmed; full C/I/A impact consistent with reported takeover outcome.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:37 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover via Oracle Outside In Technology 8.5.8 is achievable by a local attacker exploiting a flaw in the PDF Export SDK component, requiring no application-level privileges but depending on human interaction from another user on the same infrastructure. The attack vector is strictly local (AV:L), confining risk to hosts where the SDK executes, yet successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected process and host. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.

Technical ContextAI

Oracle Outside In Technology is a document parsing, viewing, and conversion SDK embedded within Oracle Fusion Middleware and used by numerous Oracle products and third-party integrations to process diverse file formats. The vulnerable component is specifically the Outside In PDF Export SDK, which handles the generation of PDF output from source documents. The CWE classification is not assigned by Oracle for this entry, leaving the precise root cause class - whether a memory corruption, malformed-input parsing error, or format-handling boundary condition - unconfirmed from available data. The affected version is 8.5.8, as identified in Oracle's August 2026 Critical Patch Update advisory. The local attack vector (AV:L) indicates the attacker must have a logon session on the host running the SDK, distinguishing this from remotely exploitable service vulnerabilities.

RemediationAI

Apply the Oracle Critical Patch Update for August 2026, which remediates this vulnerability in Outside In Technology 8.5.8. The full advisory and patch instructions are available at https://www.oracle.com/security-alerts/cspuaug2026.html. No exact patched build version number beyond the CPU reference has been independently confirmed from available data, so administrators should consult the CPU advisory matrix for the precise update identifier. If immediate patching is not operationally feasible, restrict local logon access to the infrastructure hosting Oracle Outside In Technology to the minimum set of trusted personnel, directly shrinking the attacker pool that AV:L requires. Additionally, auditing which users or processes can supply input to the PDF Export SDK component limits the human-interaction surface (UI:R) the vulnerability depends on. Both workarounds may affect legitimate document processing workflows and carry operational trade-offs that must be weighed against risk tolerance.