Oracle Outside In CVE-2026-87398

Exploitation requires that a document-processing path backed by Oracle Outside In Technology 8.5.8 (Outside In Core) accept and parse attacker-supplied files reachable over HTTP - the vector is unauthenticated and needs no user interaction (PR:N/UI:N), so no special conditions apply beyond the attacker's input reaching the parser. The practical limiting factor is that Outside In is an embedded SDK: impact is confined to applications that expose its conversion/preview functionality to untrusted input, and impact is availability-only (no data disclosure or modification), so the realistic effect is service disruption of the hosting product rather than compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with pure availability impact and no confidentiality or integrity loss - consistent with the description's 'complete DOS' via hang or repeatable crash. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only signals are the vendor-assigned CVSS and the 'Denial Of Service' tag. This means the 7.5 is a severity-driven score, not a risk-driven one: it reflects easy unauthenticated reachability but caps at availability-only impact, with no RCE or data exposure. Because Outside In is an embedded document-parsing/rendering SDK rather than a directly internet-exposed service, real-world exploitability depends heavily on whether the integrating application accepts attacker-supplied documents over HTTP - a condition the Oracle advisory does not detail. Net: a legitimate patch-worthy issue but, absent EPSS/KEV/POC evidence, a moderate-priority DoS rather than an urgent exploitation threat.

An unauthenticated attacker submits a malformed document (e.g. an uploaded file or an HTTP-delivered attachment) to an application that embeds Oracle Outside In for content conversion or preview. Parsing the crafted file triggers a hang or repeatable crash in the Outside In Core, denying the conversion/rendering service to all users. No POC is identified in the provided data, and the AV:N/AC:L vector indicates no special timing or complexity is required once malicious input reaches the parser.