EUVD-2026-106658
GHSA-553r-2jmj-wmhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious document file
-
DeliveryDeliver to HTTP service using Outside In SDK
-
ExploitVictim processes file in PDF Export SDK
-
ExecutionTrigger parsing flaw for code execution
-
ImpactCompromise Oracle Outside In Technology
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a target application that embeds the Oracle Outside In PDF Export SDK (version 8.5.8) to parse an attacker-supplied document, AND requires human interaction from a person other than the attacker (UI:R) - i.e. a user or operator must cause the malicious file to be processed; it is not self-triggering. Oracle classifies it as difficult to exploit (AC:H), which materially limits reliability. The attack is unauthenticated (PR:N) and reachable over HTTP (AV:N), but the practical exposure depends entirely on whether a reachable service feeds untrusted files into the Outside In PDF Export component; deployments that do not accept untrusted documents through this SDK are not realistically exposed. |
| Impact | This is a genuinely serious-impact flaw (full takeover, C:H/I:H/A:H) but with meaningful real-world friction, making it a moderate rather than top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) shows a network-reachable, unauthenticated vulnerability, yet two signals strongly dampen exploitability: AC:H (Oracle explicitly calls it 'difficult to exploit') and UI:R (a human other than the attacker must process a malicious file). No EPSS score was provided, so statistical exploitation probability cannot be stated. It is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The combination of high technical impact but high attack complexity plus required user interaction and no evidence of exploitation suggests this belongs in routine patch-cycle remediation (it ships via the Oracle Critical Patch Update, not an emergency bulletin) rather than emergency response. Note a signal tension: the provided Tag labels this 'Information Disclosure,' which understates the actual C:H/I:H/A:H 'takeover' impact described by Oracle - treat the full-compromise framing as authoritative. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF/document and supplies it to a server-side or client application that embeds the Oracle Outside In PDF Export SDK (for example a document-conversion, viewing, or export service exposed over HTTP). When a victim user or back-end process parses the attacker-supplied file, a flaw in the PDF Export parsing logic is triggered, leading to takeover of the Outside In component. No public exploit code is identified at time of analysis, and exploitation is rated difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Outside In PDF Export SDK 8.5.8 (part of Oracle Fusion Middleware) can be fully compromised - confidentiality, integrity, and availability all high - when a third-party application that embeds the SDK processes a maliciously crafted document. The vulnerability is unauthenticated and network-reachable over HTTP, but Oracle rates it difficult to exploit and it requires a human other than the attacker to trigger parsing of the malicious file, so practical exposure depends entirely on whether a reachable service feeds untrusted documents into the PDF Export component. No public exploit code or confirmed active exploitation was identified at time of analysis; the 7.5 score reflects the high impact and the AC:H/UI:R preconditions rather than demonstrated weaponization.
RemediationAI
Upgrade the embedded Oracle Outside In PDF Export SDK from 8.5.8 to the fixed version named in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); because the SDK is embedded, the patch must be obtained from the OEM application vendor, so track their advisory and rebuild or update the host application rather than patching Outside In in isolation. Until the fixed build is deployed, the effective compensating control is to stop feeding untrusted documents into the PDF Export path: quarantine or reject untrusted file submissions, disable PDF export or document conversion for external content, or route conversions through an isolated, low-privilege sandbox with no credentials - the trade-off being loss of automated conversion for external files, which usually requires a manual or alternate conversion workflow. Because exploitation needs a human to trigger processing of the crafted document (UI:R), user awareness and mail/file-gateway filtering of unexpected attachments reduce exposure, though they do not remove the underlying parser flaw. Monitor for the fixed version's release if the OEM vendor has not yet published it; no vendor-released patch version could be confirmed from the available data beyond the CPU reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Outside In Technology is a set of document-filtering SDKs that third-party products embed to convert, render, and extract content from hundreds of file formats - the PDF Export SDK specifically renders input documents into PDF. The flaw therefore lives in a parsing/rendering library rather than in an Internet-facing service Oracle ships directly: the real attack surface is every downstream application (DMS, mail gateways, archival, e-discovery, content-rendering services) that hands untrusted files to Outside In 8.5.8. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H vector indicates unauthenticated network delivery over HTTP, high attack complexity (Oracle's 'difficult to exploit'), a required user or operator action before the malicious document is processed, and a resulting takeback of the embedding application's confidentiality, integrity, and availability. No CWE was supplied by the reporting source, so the root-cause class (typically memory-safety or unsafe document-structure handling in the parser) is not confirmed from available data. The reference tagged 'Information Disclosure' is narrower than the assessed C:H/I:H/A:H impact and should not be read as limiting the flaw to data exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing SDK reached over HTTP without auth (AV:N/PR:N) but needs a victim to process a crafted file (UI:R) and is vendor-rated difficult (AC:H); successful parse yields full compromise (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Outside In PDF Export SDK 8.5.8, a document-conversion component shipped within Oracle Fusion Middleware and embedded in third-party applications, carries a high-severity flaw that could allow full compromise of confidentiality, integrity, and availability wherever untrusted documents are parsed. Because exploitation requires an attacker to deliver a crafted file that another person or automated workflow then feeds into the PDF Export component, the realistic exposure is concentrated in document-ingestion services and business processes that accept files from outside the organization. Leadership should care less about the raw score and more about the small number of internal or customer-facing systems that convert externally sourced documents, since those define the true blast radius and no vendor fix is currently available.
No vendor patch is available; reduce exposure by removing or disabling the PDF Export component where document conversion is not a required business function, restricting network access to conversion endpoints, accepting documents only from allow-listed senders, validating and sanitizing file types before parsing, running the SDK in a low-privilege segmented environment, and monitoring conversion services for anomalous submissions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB