EUVD-2026-106656
GHSA-3563-pf4g-5gwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local logon to host
-
ExploitSubmit crafted file to Outside In PDF Export SDK
-
ExecutionTrigger parsing flaw during conversion
-
ImpactRead subset of accessible process data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess a valid logon to the infrastructure/host where Oracle Outside In Technology executes (AV:L, local vector), and the vulnerable component is the Outside In PDF Export SDK in version 8.5.8 - so exploitation presupposes an application or workflow that embeds and invokes this SDK to process attacker-influenced documents. Limiting factors: local access is mandatory (no remote/network exploitation), impact is confined to unauthorized read access to a subset of data (no integrity or availability impact), and only version 8.5.8 is listed as affected. |
| Impact | This is a genuinely low-priority issue despite being a confirmed Oracle vulnerability. The CVSS 3.1 base score is only 4.0 (MEDIUM), driven entirely by a limited confidentiality impact (C:L, I:N, A:N). The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U is the dominant signal: although PR:N technically means no privileges, the attack vector is LOCAL (AV:L) and the description explicitly states the attacker needs 'logon to the infrastructure where Oracle Outside In Technology executes.' This is therefore NOT remotely exploitable - a meaningful mismatch to watch: PR:N without AV:N means an actor who already has some local foothold/logon, not a fully anonymous remote attacker. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or probable exploitation. SSVC framing would land at exploitation=none, technical impact=partial, automatable=no (local access prerequisite defeats mass automation). Net: a real but minor, defense-in-depth-class finding - patch on the normal Oracle CPU cycle, not an emergency. |
| Exploit ScenarioDerived | An attacker who already has a local logon on a host running software that embeds the Oracle Outside In PDF Export SDK supplies a crafted document for processing, triggering a parsing flaw that discloses a subset of in-process data (e.g., memory contents or other accessible information). No public exploit code was identified at time of analysis, and the local-access requirement means this would be a post-foothold information-disclosure step rather than an initial intrusion. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local information disclosure in Oracle Outside In Technology 8.5.8 allows an attacker who already holds a logon to the host to read a restricted subset of data accessible to the Outside In PDF Export SDK, with no integrity or availability impact. The flaw sits in the PDF Export SDK component of Oracle Fusion Middleware and is rated CVSS 3.1 base 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting low confidentiality impact only and a hard dependency on local access. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; practical risk is limited to environments where applications embed the SDK to convert attacker-influenced documents on shared or insufficiently segmented hosts.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's published vehicle for Outside In Technology fixes; because Outside In is an SDK, patching the standalone library is not sufficient on its own - every application that bundles or links the PDF Export SDK must be rebuilt, re-linked or re-bundled against the corrected 8.5.8-or-later SDK build, and ISV-supplied products embedding Outside In should be tracked to their vendor's corresponding update. Until that rebuild is complete, the most effective control is to remove the prerequisite: restrict interactive logon and remote-shell access to hosts running the document-conversion service, since the vector requires local logon, and confine conversions to dedicated low-privilege service accounts inside containers or sandboxes with read-only mounts and no access to unrelated sensitive volumes, accepting the added operational overhead of per-conversion isolation. Reduce the blast radius by co-locating no more data than the export job strictly needs on the conversion host, and monitor for unusual read patterns by the SDK-bearing process. Network segmentation or input filtering offers little benefit here because the vector is local rather than remote, and blocking ports would not address the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Outside In Technology is a family of document-processing SDKs (viewers, filters, search/export modules) licensed to ISVs and enterprises so their applications can render, convert and export hundreds of proprietary file formats without native parsers. The affected component, the Outside In PDF Export SDK, is the module that converts source documents into PDF output. Because the SDK is a library rather than a standalone service, its attack surface is whatever host application ingests untrusted documents and invokes PDF export, so the vulnerable boundary is the document-parsing/export path inside that embedding process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a local, low-complexity, no-user-interaction path where the attacker needs no credentials for the component itself (PR:N) but must already possess logon access to the infrastructure where the SDK executes, and where the outcome is partial read access to a subset of data. Oracle assigns no CWE for this entry and does not publish root-cause detail in the October 2026 Critical Patch Update; the observable classification is a data-exposure/access-control weakness in export handling, and the third-party tags of 'Authentication Bypass' should be read loosely, since the assessed vector shows no integrity or availability effect and no privilege escalation beyond what the attacker's existing local logon already grants. Only version 8.5.8 is listed as affected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Local logon prerequisite forces AV:L; PR:N matches Oracle's 'unauthenticated' wording; only partial confidentiality disclosure, so C:L with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB