Oracle Outside In CVE-2026-87393

Exploitation requires a victim application built on Oracle Outside In Technology 8.5.8 (Outside In Core) to process an attacker-supplied file, and requires human interaction from someone other than the attacker (UI:R) - typically opening, previewing, or submitting a crafted document through an HTTP-facing feature. No authentication is required (PR:N). The practical limiting factors are: the required user/victim interaction, the need for the target environment to actually embed and expose the Outside In parser, and the impact being confined to availability (crash/hang) with no data exposure or code execution indicated.

Signals are consistent and point to a moderate, availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a complete denial of service (hang or repeatable crash) - there is no confidentiality or integrity exposure. The decisive mitigating factor is UI:R: a person other than the attacker must process attacker-supplied content (consistent with Outside In's role as a file-parsing SDK), which pushes this toward targeted, interaction-dependent abuse rather than mass automated exploitation. No EPSS probability, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a legitimate patch-worthy issue but not an emergency: the absence of any integrity/confidentiality impact and the user-interaction requirement make it a lower priority than its 6.5 score might suggest in isolation. Note the input lists CWE as N/A, so the precise defect class (likely a memory-safety/parsing fault given the crash-on-content behavior) is inferred, not confirmed.

An attacker crafts a malformed document or file in a format handled by Outside In and delivers it to a victim (e.g., as an email attachment or upload) through an application that embeds the Outside In Core parser. When the victim or a backend service processes the file over an HTTP-facing workflow, the parser hangs or crashes, taking down the document-processing functionality. No public exploit code was identified in the provided data.