Oracle Outside In CVE-2026-91353

Exploitation requires that a host application embedding the Outside In Clean Content SDK 8.5.8 accept and parse an attacker-supplied document; the flaw is triggered through that document-processing path rather than a standalone network listener, so 'HTTP' reflects how untrusted files reach the SDK inside a product. Per the CVSS vector it is unauthenticated (PR:N) and needs no user interaction (UI:N), with low attack complexity (AC:L). The principal limiting factor is exposure: the SDK must be deployed and configured to process untrusted/externally-sourced documents for the vulnerability to be reachable; impact is confined to confidentiality (C:H, I:N, A:N) and crosses a scope boundary (S:C) into the hosting product.

This is a genuine high-priority confidentiality issue by raw CVSS signals: the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N scores 8.6 and describes a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) flaw with a scope change (S:C) and high confidentiality impact but no integrity or availability impact. However, no corroborating exploitation signals were supplied: no EPSS probability, no CISA KEV entry, and no public exploit were provided, so the real-world urgency cannot be elevated beyond the theoretical. Oracle Outside In is a file-parsing/document-filtering SDK that is typically reached by submitting a crafted document for processing rather than by a direct listening HTTP service, so the 'network access via HTTP' phrasing describes how the malicious file reaches the SDK inside a host application rather than a standalone exposed port - the practical attack surface depends entirely on whether and how a host product exposes Outside In to untrusted documents. No SSVC decision data was provided. Net assessment: patch per Oracle's October 2026 CPU cadence as a high-severity confidentiality/information-disclosure item, but absent EPSS/KEV/POC evidence there is no indication of active or imminent widespread exploitation.

An attacker submits a specially crafted document (e.g. an uploaded file or email attachment) to an application that embeds the Outside In Clean Content SDK for content extraction or conversion. When the SDK parses the malformed file it discloses confidential in-memory data (such as adjacent buffer contents) back through the hosting product, exposing data the attacker should not be able to read. No public proof-of-concept was provided in the input.