Oracle Outside In Technology CVE-2026-87304

Oracle's CPU description is sparse and names no explicit configuration prerequisite, stating only 'easily exploitable' unauthenticated network access via HTTP. The concrete realistic precondition is that Outside In Technology 8.5.8 must be embedded in a reachable service that accepts and parses attacker-supplied documents through the Outside In Core component over HTTP - because Outside In is a library, exploitability depends on the embedding product exposing its parsing path to untrusted input. Limiting factors: the target product must actually route attacker-controlled files into Outside In Core, and must be running the affected 8.5.8 version; impact is confined to confidentiality (no integrity or availability loss), so this cannot directly be used for code execution or service disruption based on the stated vector.

The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, a scope change, and high confidentiality impact (integrity and availability unaffected). This signals a serious confidentiality-disclosure issue rather than a code-execution or availability threat. However, the only corroborating intelligence signals are MISSING: no EPSS probability was provided, the vulnerability is NOT in CISA KEV, no public POC is referenced, and no SSVC decision data accompanies the entry. The sole reference is Oracle's October 2026 Critical Patch Update page, which is characteristically terse and provides no CWE, root-cause detail, or exploitation telemetry. Oracle Outside In is a document-parsing/filtering SDK embedded inside other products, and the declared scope change (S:C) reflects that a flaw in the Core parser can affect the embedding host product. Net assessment: this is a genuinely high-severity confidentiality bug by CVSS, but with no exploitation evidence (no KEV, no EPSS, no POC) its real-world urgency is driven by patch-availability and exposure rather than confirmed active attack - treat as a priority to patch during the Oracle CPU cycle, but not an emergency absent exploitation signals. Note the conflicting 'Authentication Bypass' tag, which does not fit a confidentiality-only (C:H/I:N/A:N) parser flaw and should be verified.

An attacker sends a maliciously crafted document over HTTP to an internet- or network-reachable service that uses Oracle Outside In Technology to parse or convert uploaded files. The crafted file triggers a flaw in the Outside In Core parser that discloses critical data, and because of the scope change the impact extends into the embedding host product's data. No public exploit code is identified at time of analysis, so weaponization would require original research.