Oracle Outside In CVE-2026-91345

Exploitation requires the target to process an attacker-supplied document through the Outside In Clean Content SDK component (version 8.5.8) - i.e., an application that feeds untrusted files to the SDK over an HTTP-reachable path. Per the CVSS vector (PR:N/UI:N/AV:N), no authentication, no user interaction, and no special non-default configuration are required beyond the SDK being deployed and reachable with attacker-controlled input. The primary limiting factor is architectural: Outside In is an embedded library, so exploitability hinges on the host product actually exposing a document-ingestion endpoint to untrusted senders; environments that only process trusted, internal files have a much smaller realistic attack surface. Impact is confined to availability (service hang/crash) - no data disclosure or modification.

All exploitability signals point to easy remote attack: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector, and Oracle's own description reinforces 'easily exploitable' by an unauthenticated attacker over HTTP. However, impact is strictly limited to availability (C:N/I:N/A:H) - the outcome is a hang or repeatable crash (complete DoS), with no confidentiality or integrity loss, which is why the base score caps at 7.5 (HIGH) rather than CRITICAL. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no public evidence of active exploitation or automatable mass exploitation at time of analysis - this reads as a high-CVSS availability bug rather than a confirmed in-the-wild priority. One point to verify: Outside In Technology is historically an embedded file-parsing SDK, so 'network access via HTTP' likely reflects the host application exposing the SDK rather than the SDK being a standalone network service - the real-world attack surface depends on how the embedding product receives untrusted documents; verify with the integrating vendor.

An unauthenticated attacker submits a specially crafted document to an application that embeds the Outside In Clean Content SDK (for example via an HTTP-facing document conversion, preview, or content-extraction endpoint). The malformed file drives the SDK's parser into an infinite hang or a repeatable crash, taking down the document-processing service. No public exploit code was identified in the provided data, but low attack complexity (AC:L) and no required privileges or user interaction make reliable triggering plausible once a malformed-input vector is known.