This vulnerability affects Oracle Outside In Technology version 8.5.8 and is classified under CWE-502. It permits an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product. Exploitation requires user interaction from a person other than the attacker. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector with low complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly state patch availability for this specific version in the provided content.

If exploited, this vulnerability can result in complete takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability of the affected system. The attack requires an attacker to have logon access to the infrastructure and involves human interaction from a third party, which may limit exploitability. No known exploits in the wild have been reported at this time.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Customers should remain on actively supported versions and apply Oracle's security patches without delay. The vendor advisory does not explicitly confirm a patch for version 8.5.8; therefore, users should consult the Oracle Critical Security Patch Update advisory for August 2026 for the latest patch availability and installation instructions. Until patched, minimizing logon access to the infrastructure where Oracle Outside In Technology executes may reduce risk.