Oracle Outside In Technology CVE-2026-60414

The attacker must already possess logon access to the infrastructure host where Oracle Outside In Technology 8.5.8 executes - this is a local attack (AV:L), not a remote network attack. No privileges within the application itself are required (PR:N in CVSS), meaning any user capable of logging onto the system qualifies as a potential attacker. Human interaction from a person other than the attacker is a mandatory prerequisite (UI:R): a separate user must trigger the document processing action, such as opening or submitting a file to the Outside In pipeline. Exploitation is therefore limited by the combination of required local infrastructure access and dependency on victim interaction - it cannot be triggered remotely or in a fully automated, unattended manner. The vulnerability is only confirmed in version 8.5.8; other versions are not in scope per available data.

The CVSS 3.1 score of 7.8 (High) is driven by the full C:H/I:H/A:H impact triad, reflecting complete system takeover potential. However, the attack vector AV:L significantly constrains the threat surface relative to a network-exploitable vulnerability - only actors with existing logon access to the infrastructure can stage an attack. The mandatory UI:R (user interaction required) further limits automated or mass exploitation, preventing worm-like spread. No EPSS data was provided, and the vulnerability is not currently listed in the CISA KEV catalog, meaning active exploitation has not been confirmed by authoritative sources. The combination of local access and required human interaction means that even a mid-sized municipal IT team in sanok should treat this as urgent primarily in environments where Oracle Fusion Middleware processes documents ingested from untrusted external sources or shared network locations. The real-world risk is highest in document-processing pipelines where external files are automatically queued for Outside In parsing. There is no known POC; absent KEV listing and EPSS data, the exploit development barrier is currently unquantified.

An attacker with local logon access to a server running Oracle Outside In Technology 8.5.8 places a specially crafted malicious document in a directory monitored or accessible by the Outside In processing pipeline. When a legitimate user or automated workflow triggers document processing - such as opening, indexing, or converting the file - the Outside In Core parsing engine processes the malformed content, triggering the vulnerability and granting the attacker full control over the affected system. No public exploit code has been identified at time of analysis, so this scenario currently requires custom exploit development.