Oracle has disclosed an easily exploitable, unauthenticated network vulnerability in Oracle Outside In Technology 8.5.8. According to Oracle, a successful attack can result in unauthorized creation, deletion, or modification of critical data, and can let an attacker cause a hang or repeatable crash (complete denial of service). The flaw carries a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-91341 is a vulnerability in the Outside In Clean Content SDK, a component of Oracle Outside In Technology, which is part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access via HTTP can use it to compromise the product.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Impact: None to confidentiality, High to integrity, High to availability
Why It Matters
Exploitation needs no authentication and no user interaction, and the attack complexity is low. Oracle says a successful attack can result in:
- Unauthorized creation, deletion, or modification of critical data, or of all data that Oracle Outside In Technology can access
- The ability to cause a hang or a frequently repeatable crash (complete DoS) of Oracle Outside In Technology
The CVSS rating covers integrity and availability only. Oracle does not list any confidentiality impact.
Exploitation status: CVE-2026-91341 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm any active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Oracle Corporation | Oracle Outside In Technology (Oracle Fusion Middleware) | Outside In Clean Content SDK | 8.5.8 |
Oracle names 8.5.8 as the affected supported version. The NVD record does not list any CPE entries yet. Its status is "Received," meaning NVD has not finished its analysis.
Patch Status
Oracle's reference for this CVE is its October 2026 Critical Patch Update advisory. Organizations running Oracle Outside In Technology 8.5.8 should check that advisory for fix and remediation guidance and apply the relevant patches. This matters most where the Clean Content SDK can be reached over HTTP.
There is no CISA KEV entry, so no federal remediation deadline or required action applies at this time.