Oracle Outside In CVE-2026-91340

Requires low-privileged authenticated access (PR:L) to an application or service that embeds the Oracle Outside In Clean Content SDK, reachable over HTTP, specifically version 8.5.8; the attacker must be able to submit a document/content payload that the SDK parses. No user interaction is required. Limiting factors: exploitation is gated by the PR:L authentication requirement and is bounded to deployments actually running the 8.5.8 Clean Content SDK component - because Outside In is an embedded library, actual exposure depends on whether and how the integrating product accepts attacker-supplied files for processing.

All signals here are vendor-sourced from Oracle's October 2026 Critical Patch Update; no independent enrichment is present. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an easily exploitable, network-reachable flaw that needs only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss ('takeover'). That is a genuinely serious profile. However, the real-world-exploitation modifiers that normally elevate priority are absent: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The one conflicting signal is the 'Information Disclosure' tag, which understates a vulnerability that Oracle itself describes as full takeover with high integrity and availability impact - treat the tag as incomplete, not the CVSS. Net: this is a legitimately high-severity, patch-now issue for anyone running the affected SDK, but the current evidence points to potential rather than confirmed or widespread exploitation, so it ranks below actively-exploited KEV entries in triage. Because Outside In is a parsing library embedded inside other products, the PR:L requirement should be verified against how your specific integrating application exposes it.

A low-privileged but authenticated user of an application that embeds the Outside In Clean Content SDK 8.5.8 submits a maliciously crafted document over HTTP to be parsed or converted. A flaw in the SDK's content-processing logic is triggered during parsing, allowing the attacker to compromise and take over the Outside In Technology component. No public proof-of-concept is referenced, and no active exploitation is confirmed.