Oracle Outside In CVE-2026-91349

Exploitation requires that an application embedding the Oracle Outside In Clean Content SDK (version 8.5.8) accepts and parses an attacker-supplied document through a network/HTTP-reachable path. The limiting factor is reachability of the parser: the SDK is a library, so an attacker-controlled file must actually reach the Outside In processing routine (e.g., a document-upload, conversion, or content-extraction feature). Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, and attack complexity is low (AC:L); the impact is limited to availability (hang/repeatable crash) with no confidentiality or integrity effect, so the practical risk is service downtime rather than compromise.

This is a genuine but bounded availability risk, not a high-severity escalation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, network-reachable, unauthenticated flaw, and the 7.5 score derives ENTIRELY from availability impact (A:H) with zero confidentiality or integrity impact (C:N/I:N) - the outcome is a hang or repeatable crash (complete DoS) of Oracle Outside In Technology, not code execution or data compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization; exploitation probability cannot be quantified from the data given. The realistic priority is MODERATE: patch it in normal cycle rather than as an emergency, prioritizing instances where Outside In's Clean Content SDK is exposed to untrusted file input in availability-sensitive services. Note a nuance for verification: although the CVSS vector asserts AV:N via HTTP, Outside In is a file-parsing SDK embedded in host applications, so the 'network' vector in practice means an attacker must get a crafted document to the parser (e.g., via an upload or document-processing endpoint) - the true reachability depends on how the embedding application exposes the SDK; verify with the Oracle CPU advisory and the integrating product's configuration.

An attacker submits a specially crafted document to an application that uses the Oracle Outside In Clean Content SDK (version 8.5.8) to extract or process file content over an HTTP-facing endpoint. When the SDK parses the malformed file, it hangs or crashes, producing a complete denial of service of the Outside In processing component and any dependent service. No authentication or user interaction is required, but no public exploit code was identified at time of analysis.