Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91354updated 25 Oct 2026, 18:50 UTC

Oracle Outside In Clean Content SDK 8.5.8 can be fully taken over over the network

A weakness in a file-cleaning tool from Oracle lets someone with a basic user account reach it over the network and take control of it. Because the tool can affect other systems around it, the damage can spread beyond this one product.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privilege attackerNeeds only a basic account
  2. 2Sends HTTP requestsReaches the service over the network
  3. 3Outside In SDK flawEasy to exploit in version 8.5.8
  4. 4Product taken overFull control of the component
  5. 5Other products hitScope change spreads the impact
  6. ResultAttacker takes over the product and affected neighbours

What happened

Oracle Outside In Technology, specifically the Outside In Clean Content SDK component of Oracle Fusion Middleware, version 8.5.8, has a flaw that allows a low-privileged attacker with HTTP network access to fully compromise the product, with scope change to other products.

Why it is dangerous: A successful attack can lead to complete takeover of the affected product, with high impact on confidentiality, integrity, and availability, and it may reach additional products. Organizations running document-processing or content-cleaning services that expose this SDK over HTTP are at risk.

Are you affected?

You are affected if you run Oracle Outside In Technology (Clean Content SDK) version 8.5.8 in a setup where it is reachable over HTTP from the network.

Oracle Outside In Technology, Oracle Fusion Middleware, Outside In Clean Content SDK, supported version 8.5.8

What to do

  1. Check whether you run Oracle Outside In Clean Content SDK version 8.5.8 and where it is reachable from
  2. Restrict network access to the affected service, allowing only trusted internal sources, until a fix is installed
  3. Apply the official Oracle Critical Patch Update or vendor fix as soon as it is available for your version

Timeline

  1. 20 Oct 2026, 22:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:20 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91354 · GHSA-7cgc-r9r4-wc2h
CVSS
9.9 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:20 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Outside In Clean Content SDK 8.5.8 can be fully taken over over the network · Zero Radar