Outside In Technology CVE-2026-91346

Exploitation requires a victim (a person or automated process other than the attacker) to open or process an attacker-crafted document/file using an application that embeds the Oracle Outside In Clean Content SDK (version 8.5.8) - this UI:R requirement is the primary limiting factor. No authentication is required (PR:N) and the file can be delivered remotely over HTTP (AV:N), but the attack cannot fire without the victim-side parsing action, so purely autonomous mass exploitation is not possible. The scope change (S:C) means impact depends on the privileges and trust boundaries of the host product embedding the SDK.

This is a genuine high-severity issue (CVSS 8.2) but not a top-of-queue emergency on current signals. The CVSS vector is network-exploitable (AV:N) with low complexity (AC:L) and no privileges (PR:N), and the scope change (S:C) plus high confidentiality impact (C:H) drive the elevated score. The critical mitigating factor is UI:R - successful attacks require human interaction from a victim other than the attacker, which is consistent with Outside In being a document-parsing SDK where a user or server-side process must open/convert an attacker-supplied file. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this moderates real-world urgency relative to the raw score. A notable conflict: the input Tags label this 'Authentication Bypass', but the CVSS vector (UI:R, S:C, C:H/I:L) and the Oracle description describe a file-processing vulnerability, not an authentication bypass - treat the tag as suspect and verify with the Oracle CPU advisory. Overall: patch on a normal prioritized cycle; the UI:R requirement and absence of exploitation signals argue against treating it as an active threat, while the unauthenticated network reach and scope change argue against deferring it indefinitely.

An attacker crafts a malicious document and delivers it over HTTP to a service or user whose application embeds the Oracle Outside In Clean Content SDK (e.g., a document-conversion or content-filtering pipeline). When the victim process parses the file, the flaw triggers, enabling unauthorized access to critical data and limited data modification, with impact extending into the embedding host product (scope change). No public exploit code was identified at time of analysis.