Outside In Technology CVE-2026-91355

Exploitation requires the attacker to first possess a local logon ('logon to the infrastructure where Oracle Outside In Technology executes') on a host running the Outside In Clean Content SDK version 8.5.8 - this LOCAL-access prerequisite (AV:L) is the primary limiting factor and rules out direct remote/network exploitation. No application-level authentication is needed once local access is held (PR:N), no user interaction is required (UI:N), and complexity is low (AC:L). The concrete exploitation surface is the Clean Content SDK's file/document parsing path, so a deployment is only at risk where untrusted content is processed by this component; hosts where the SDK is not exposed to attacker-supplied input or where no untrusted local users exist are not realistically exploitable.

Multiple signals must be weighed against each other here. The CVSS 3.1 base score of 8.4 (High) is driven by full Confidentiality, Integrity and Availability impact (C:H/I:H/A:H) culminating in product takeover, but the attack vector is explicitly LOCAL (AV:L), not network - Oracle's boilerplate phrase 'unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes' confirms the attacker must already have a foothold (a local/console logon) on the host, even though no application-level authentication is required (PR:N). This tension is important: the high score reflects impact severity, not ease of remote reach. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC framework data supplied. The single reference is Oracle's October 2026 Critical Patch Update advisory, indicating a patch is available. Net assessment: this is a genuinely high-impact flaw (full takeover) but its real-world risk is throttled by the local attack vector - it is realistically a post-compromise privilege/impact escalation or a risk in multi-tenant/shared-host deployments, not a mass-exploitable internet-facing issue. Note also a metadata conflict: the input Tag labels this 'Information Disclosure,' yet the description and CVSS vector describe full C/I/A compromise and takeover - the tag understates the impact; rely on the CVSS vector.

An attacker who already holds a low-privilege local logon on a server that embeds the Outside In Clean Content SDK (e.g. a document-processing or content-filtering host) supplies a malicious file or input that is parsed by the SDK, triggering memory corruption or similar flaw that yields full takeover of the Outside In Technology process. Because the CVSS vector is AV:L/AC:L/PR:N, exploitation is low-complexity and needs no application credentials once local access exists. No public exploit code is identified at time of analysis.