Oracle Outside In CVE-2026-60412

Exploitation requires the attacker to hold a local logon account on the infrastructure host where Oracle Outside In Technology 8.5.8 is installed - the CVSS vector AV:L explicitly excludes remote network-based exploitation. A second, distinct prerequisite is human interaction from a person other than the attacker (UI:R per CVSS), meaning a victim user must open, queue, or otherwise trigger the parsing of an attacker-supplied file through the Outside In Core component; fully automated, unattended exploitation is not possible. No special system privileges are required of the attacker beyond the ability to log on (PR:N). Exploitation is limited by version - only 8.5.8 is confirmed affected. The human interaction gate limits risk in environments where OIT processes only internally generated or tightly controlled documents, but is effectively neutralized in document-ingestion pipelines where external files are processed by default as part of normal operations.

The CVSS 7.8 score reflects a real but gated threat: the local attack vector (AV:L) is the most significant limiting factor, confining exploitation to actors who already hold logon credentials on the host running OIT 8.5.8, which eliminates the vast majority of remote opportunistic attackers. The additional human interaction requirement (UI:R) means the attack cannot proceed autonomously - a victim must actively engage with attacker-controlled input, further narrowing the realistic exploitation window. That said, environments where OIT processes files sourced from external or untrusted parties - common in document conversion pipelines and content ingestion workflows - effectively collapse the UI:R gate because the victim's normal job function IS the interaction. The low attack complexity (AC:L) and no privilege requirement (PR:N for local access) mean an attacker who clears the AV:L threshold faces no further technical hurdles, and even a mid-sized municipal IT team in swidnica operating an Oracle Fusion Middleware deployment should treat this as urgent if their OIT host is accessible to non-admin users or if it processes externally sourced documents. No EPSS score was available to quantify population-level exploitation probability, no CISA KEV listing confirms active exploitation, and no POC was identified - collectively these signals suggest the threat is credible but not yet widely observed in the wild. The tag 'Information Disclosure' in the source data conflicts with the CVSS C:H/I:H/A:H triad and Oracle's own 'takeover' language; the CVSS and description are considered authoritative here.

An attacker with a local account on a host running Oracle Outside In Technology 8.5.8 crafts a malicious document file - likely targeting the Outside In Core parser's handling of a specific format - and places it in a directory that an authorized user or automated workflow will process through OIT. When the victim opens or triggers parsing of the malicious file (fulfilling the UI:R requirement), a memory corruption condition fires inside the native parsing engine, allowing the attacker to redirect execution and achieve full control over the OIT process. No public proof-of-concept has been identified, but the low attack complexity implies a skilled attacker could develop a reliable exploit relatively quickly once they have identified the specific parsing flaw.