Oracle Outside In Technology CVE-2026-91350

Exploitation requires that a host application actually invokes the Oracle Outside In Clean Content SDK 8.5.8 to parse attacker-supplied files, and that a crafted/malformed document can reach that parsing path over HTTP (e.g., an exposed upload, file-conversion, content-cleaning, or inspection feature). No authentication or user interaction is needed per the vector (PR:N/UI:N, AC:L). The practical limiting factor is exposure of the document-processing pipeline to untrusted input: deployments that never feed external files to the SDK, or that isolate/sandbox the parser, are not reachable. Impact is confined to availability (hang or repeatable crash of the Outside In engine); no data disclosure or code execution results.

All provided signals are internally consistent for a network-exploitable denial-of-service issue. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates an unauthenticated, low-complexity, network-reachable flaw with no user interaction and availability-only impact - there is no confidentiality or integrity loss, so this is purely an uptime/stability risk rather than a data-breach or code-execution risk. Despite the 'High/7.5' score, the real-world priority is moderate rather than urgent: the ceiling of impact is a hang or repeatable crash (complete DOS) of the Outside In parsing engine, not RCE. No EPSS score, CISA KEV listing, SSVC decision data, or POC was provided in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' A key caveat: Outside In Technology is an embedded file-parsing SDK, so 'network access via HTTP' reflects how host applications typically receive attacker-supplied documents rather than Outside In itself listening on a port; actual exposure depends entirely on whether the integrating product feeds untrusted files to the Clean Content SDK. Treat as a standard-cycle patch (Oracle CPU October 2026) prioritized by how exposed your document-processing path is, not as an emergency.

An unauthenticated attacker submits a specially crafted document (e.g., via a web-facing upload, conversion, or content-inspection feature) to an application that embeds the Oracle Outside In Clean Content SDK 8.5.8. When the SDK parses the malformed file, it hangs or crashes, taking down the document-processing service for all users. No POC or active exploitation is reported in the provided data; the network/low-complexity/no-auth vector makes delivery straightforward wherever untrusted files reach the parser.