Oracle Outside In CVE-2026-91354

Exploitation requires the vulnerable Oracle Outside In Clean Content SDK version 8.5.8 to be embedded in and reachable through a product that accepts attacker-supplied content for parsing/conversion over HTTP. The CVSS PR:L means the attacker needs low-level authenticated access to that embedding application (authentication is required per PR:L, not unauthenticated), but no user interaction is needed (UI:N) and complexity is low (AC:L). The practical limiting factor is reachability of the SDK's parsing path: the host product must expose a feature (upload, document preview, content extraction, or conversion) that feeds untrusted files to the SDK. The scope change (S:C) is central - successful attacks can significantly impact the host product beyond the SDK itself, which is what drives the severity.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) scores 9.9 because of a scope change - a flaw in the Outside In Clean Content SDK can impact the broader host product that embeds it. All exploitation barriers are low: network reachable over HTTP, low attack complexity, only low privileges required, and no user interaction. That said, several key real-world signals are MISSING: no EPSS exploitation-probability score was provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. The 9.9 is driven almost entirely by the scope change and triple-high impact rather than by evidence of active exploitation. Oracle Outside In is a file-parsing/document-conversion SDK embedded inside other products, so 'low privileged' realistically means an attacker able to submit a crafted document to a service that uses the SDK; actual reachability depends entirely on how the embedding product exposes the parser. Treat this as a must-patch item in Oracle's October 2026 CPU cycle, while recognizing that widespread opportunistic exploitation is not yet demonstrated.

An authenticated low-privileged user submits a maliciously crafted document (e.g., via an upload, conversion, or preview feature) to an application that embeds the Outside In Clean Content SDK 8.5.8. The SDK mishandles the crafted file during parsing, and because of the scope change the compromise extends beyond the SDK to take over the host product. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's description.