CVE-2026-91354 is a critical (CVSS 9.9) vulnerability in the Outside In Clean Content SDK component of Oracle Outside In Technology 8.5.8: a low-privileged attacker with HTTP network access can exploit it easily and take over the product.
What Is It
CVE-2026-91354 affects Oracle Outside In Technology, part of Oracle Fusion Middleware. The flaw is in the Outside In Clean Content SDK component. Oracle describes it as "easily exploitable." An attacker needs network access over HTTP and low-level privileges to compromise the product, and no user interaction is required.
Oracle reported the issue, and NVD published it on 2026-10-20. NVD lists the record's status as "Received," so it has not yet been analyzed further.
Why It Matters
The CVSS 3.1 base score is 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Key points:
- Network-reachable: It can be exploited remotely over HTTP.
- Low complexity: Exploitation needs no special conditions.
- Scope change: The bug is in Outside In Technology, but Oracle notes that attacks "may significantly impact additional products." Applications that embed or depend on the SDK could also be affected.
- Full impact: A successful attack has high impact on confidentiality, integrity and availability, and can result in takeover of Oracle Outside In Technology.
KEV status: The supplied data contains no CISA KEV entry for this CVE. Active exploitation is not confirmed by KEV at the time of writing.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Outside In Technology (Oracle Fusion Middleware)
- Component: Outside In Clean Content SDK
- Affected version: 8.5.8 (the supported version Oracle lists as affected)
The NVD record does not list any affected CPEs yet.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory. Administrators running Outside In Technology 8.5.8 should check that advisory for remediation guidance and apply Oracle's fix. They should also identify any products that bundle the Clean Content SDK, because of the scope-change impact.
There is no CISA KEV entry, so no federal remediation deadline or required action applies to this CVE right now.