This vulnerability affects Oracle Outside In Technology version 8.5.8, allowing an unauthenticated attacker with local access (logon) to the infrastructure to compromise the product. Successful exploitation requires user interaction from a third party. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). No specific patch is listed in the advisory, and no known exploits are reported in the wild. Oracle’s August 2026 Critical Security Patch Update advisory mentions this vulnerability but does not provide a direct patch link for this version.

Successful exploitation can result in complete takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability of the affected component. The attacker does not need prior privileges but requires local logon and user interaction from another person. This can lead to unauthorized control and potential disruption of services relying on this technology.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Updates. However, no specific patch for version 8.5.8 of Oracle Outside In Technology is explicitly provided in the advisory. Organizations should monitor Oracle’s security advisories for updates and consider restricting local access to the infrastructure where this technology executes to mitigate risk. Patch status is not yet confirmed for this specific version—check the Oracle advisory for current remediation guidance.