Oracle Outside In CVE-2026-91352

Exploitation requires the Oracle Outside In Clean Content SDK (version 8.5.8) to process attacker-supplied content - i.e., the vulnerability is reachable only through a host application that feeds untrusted files or data into the Clean Content SDK parser and exposes that path over HTTP. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required once such a content-processing endpoint is reachable. The principal LIMITING factor is impact scope: Oracle states attacks yield only a PARTIAL denial of service of Outside In Technology (A:L), with no confidentiality or integrity effect, so a successful attack degrades parsing/conversion availability rather than enabling data theft or code execution. Because Outside In is an embedded SDK, real exposure depends on whether a deployed product actually routes untrusted input through it.

This is a moderate-severity, low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and the only impact is a PARTIAL denial of service (A:L) - there is no confidentiality or integrity impact (C:N/I:N). Oracle itself classifies attacks as resulting only in a 'partial DOS,' which materially limits real-world consequence to a degradation rather than a full outage. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; absence of KEV/POC is not evidence of safety but means there is no public signal of active exploitation or weaponization. The one point of nuance: the CVSS vector asserts network attack via HTTP (AV:N), yet Outside In Technology is a file-parsing SDK embedded in other applications, so 'network access via HTTP' in practice means attacker-controlled content reaching the parser through a host application - the raw AV:N can overstate directness without that host context. Overall this is a genuine-but-low priority: real (unauthenticated, network-triggerable) but capped by partial-DoS-only impact and no exploitation evidence.

An attacker submits a specially crafted document or file to an application that uses the Oracle Outside In Clean Content SDK 8.5.8 to parse or convert content (e.g., a document-ingestion or content-filtering pipeline exposed over HTTP). The malformed file triggers a fault in the parser that degrades or interrupts the processing service, causing a partial denial of service. No public exploit code was identified at time of analysis, and because impact is only partial DoS, the practical outcome is service degradation rather than full compromise.