Oracle Outside In CVE-2026-91351

Exploitation requires an authenticated low-privileged logon (PR:L) on the infrastructure/host where Oracle Outside In Technology executes - it is a local vector (AV:L) with no network reachability, no victim user interaction (UI:N), and an unchanged scope (S:U). The practical trigger is parsing of attacker-supplied content through the Outside In Clean Content SDK, so exploitation is limited to contexts where the attacker can both log on locally and get a crafted file processed by the SDK (directly or via an embedding application). Only version 8.5.8 is listed as affected; the absence of a remote path and the requirement for existing local credentials are the key limiting factors reducing real-world exposure.

This is a moderate-severity, operationally-constrained issue rather than a top-tier emergency. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 6.1) describes a locally-exploitable flaw requiring an already-authenticated low-privileged account (PR:L) on the host where Outside In Technology runs - there is no network attack surface (AV:L), which sharply limits remote mass exploitation. Impact is high to integrity (I:H: unauthorized create/delete/modify of accessible data) and partial to availability (A:L), with no confidentiality loss (C:N). No EPSS score was supplied in the input, the CVE is not present in CISA KEV, and no public proof-of-concept is referenced, so all three real-world exploitation signals are either absent or negative. No SSVC decision data was provided. The net picture is a credible but access-gated defect: because Outside In is a file-parsing SDK embedded in other products, real risk depends heavily on whether an attacker can already run code/supply files on the host, so this is a patch-in-normal-cycle item rather than an exploited-in-the-wild priority. Note the 'Denial Of Service' tag slightly overstates the availability dimension, which the CVSS marks only as partial (A:L).

A low-privileged user who already has a logon on a server running Oracle Outside In Technology 8.5.8 (or an application embedding the Clean Content SDK) supplies a maliciously crafted document to be parsed by the SDK. Parsing the crafted file triggers the flaw, letting the attacker tamper with or destroy data accessible to the Outside In process and partially disrupt its availability. No public exploit code is identified at time of analysis, and no user interaction by a victim is required.