Oracle Outside In Technology CVE-2026-60413

Exploitation requires the attacker to have logon access to the infrastructure where Oracle Outside In Technology 8.5.8 executes - the CVSS AV:L metric confirms the attack cannot be launched directly over the network. The attacker does not require any specific privilege level on the system (PR:N), only the ability to place or deliver a crafted file that the victim or an automated process will open. Human interaction from a person other than the attacker is explicitly required (UI:R) - a legitimate user or service account must open or trigger parsing of the malicious document. Exploitation is limited to version 8.5.8 of the Outside In Core component. The attack scope is unchanged (S:U), meaning the exploit does not cross privilege boundaries to impact other system components. Environments where OIT is configured to auto-process inbound documents from external sources reduce the effective user-interaction barrier, since a service account fulfills the UI:R condition automatically.

The CVSS 3.1 base score of 7.8 reflects high CIA impact with low attack complexity, but the local attack vector (AV:L) and required user interaction (UI:R) materially constrain real-world exploitability compared to a network-reachable flaw. An attacker cannot directly reach this over the network without first obtaining local access or convincing a user to process a weaponized file. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag in the source intelligence conflicts with the CVE description and CVSS metrics, which indicate full takeover (C:H/I:H/A:H) - defenders should treat the CVE description and vector as authoritative over the tag. In environments where Oracle WebCenter Content or similar OIT-integrated services automatically process inbound documents (email attachments, upload portals), the user interaction barrier is partially reduced because the 'interaction' may be a service account processing files automatically, which could shift practical severity upward. No POC is publicly identified at time of analysis.

An attacker with a foothold on the network (or via phishing) delivers a specially crafted document - such as a malformed Office or PDF file - to a directory monitored by an Oracle Content Server or WebCenter Content instance running Outside In Technology 8.5.8. When a legitimate user or automated service account processes the file, the Outside In Core parser mishandles the malicious input, triggering a memory corruption or similar flaw that gives the attacker full control over the OIT process with high confidentiality, integrity, and availability impact. No public proof-of-concept has been identified at time of analysis, but Oracle's OIT has a documented history of parser-level memory corruption vulnerabilities exploitable via this exact mechanism.