Oracle Outside In EUVD-2026-106728

Exploitation requires that Outside In Technology 8.5.8 actually process an attacker-supplied file, and it requires human interaction from a person other than the attacker (UI:R) - i.e., a victim must open, convert, or otherwise cause OIT to parse the malicious document. The attack is local (AV:L): the attacker needs a logon/execution foothold on the infrastructure where OIT runs or must get their crafted file into a local processing workflow. Limiting factors that reduce real-world risk: no remote network vector, the dependency on a victim action, and the fact that only deployments embedding/using OIT 8.5.8 to parse untrusted content are exposed. No authentication is required of the attacker (PR:N), but the local-access and user-interaction prerequisites meaningfully constrain exploitation.

Oracle rates this 7.8 HIGH with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning local attack vector, low complexity, no privileges, but mandatory user interaction. Despite the PR:N 'unauthenticated' metric, the AV:L vector combined with Oracle's description ('attacker with logon to the infrastructure where Oracle Outside In Technology executes' plus required human interaction) makes this a local, user-interaction-gated issue rather than a remotely automatable one - a signal worth flagging, since the raw PR:N can be misread as wormable remote exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active exploitation or widespread automated attack. Outside In Technology is a document/file-format parsing engine, so realistic risk centers on a victim processing a malicious file. Net assessment: a genuinely impactful (full takeover, C/I/A all High) but exploitation-constrained flaw - a priority for environments that embed OIT to parse untrusted files, but not an emergency mass-exploitation scenario given the local vector and required human interaction.

An attacker crafts a malicious document in a format handled by Outside In Core and delivers it to a user or system that processes untrusted files through OIT (e.g., a content-conversion, DLP, or indexing pipeline). When a person other than the attacker opens or processes the file locally, a parsing flaw is triggered, leading to full compromise of the Outside In Technology component. No public exploit code was identified at time of analysis.