Outside In Technology CVE-2026-87394

Exploitation requires an application that embeds Oracle Outside In Technology 8.5.8 and feeds attacker-supplied files to the Outside In Core parser (e.g., document conversion, preview, indexing, or content-extraction features exposed over HTTP). No authentication is required (PR:N) and no user interaction is needed (UI:N), and attack complexity is low (AC:L). The principal limiting factor is deployment surface: Outside In is a library, not a listening service, so risk exists only where the host application accepts untrusted documents and routes them to Outside In - environments that do not expose such file-processing paths to untrusted input are not reachable. Impact is bounded to confidentiality (critical data disclosure) and a partial, not full, denial of service; there is no integrity impact and no scope change to other components.

Multiple signals paint a moderately high but not emergency risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is favorable to attackers - network reachable over HTTP, low complexity, no privileges and no user interaction - and the 8.2 base score is driven by high confidentiality impact (C:H) plus a partial availability impact (A:L), with no integrity impact (I:N) and no scope change (S:U). However, several escalation signals are ABSENT from the provided data: no EPSS score, no CISA KEV listing, and no indication of public exploit code. Outside In Technology is a file-parsing/content-extraction SDK embedded inside other applications, so the AV:N 'via HTTP' rating realistically presupposes an embedding application that accepts attacker-supplied documents - the network reachability is inherited from the host application, not intrinsic to the library. This is therefore a genuine patch priority for environments that expose Outside In-backed document processing to untrusted input, but in the absence of EPSS/KEV/POC it is not evidence of active or widespread exploitation. One data conflict to verify: the 'Authentication Bypass' input tag is not supported by the description, which describes an already-unauthenticated flaw (PR:N) rather than a bypass of an auth control.

An attacker submits a specially crafted document (e.g., an uploaded file or a document passed to a conversion/preview endpoint) to an application that embeds Oracle Outside In Technology 8.5.8. When Outside In Core parses the malformed file, the flaw yields unauthorized access to sensitive in-process data and can partially degrade the service. No authentication or user interaction is required and attack complexity is low; no public proof-of-concept was identified at time of analysis.