This vulnerability affects Oracle Outside In Technology version 8.5.8 and allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product. Exploitation requires user interaction from a third party. The impact includes complete compromise of the Oracle Outside In Technology component, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates low attack complexity and no privileges required but user interaction is necessary. Oracle’s August 2026 Critical Security Patch Update advisory mentions many patches but does not explicitly confirm a fix for this version or vulnerability. Patch status is therefore not confirmed and should be verified with Oracle’s advisory.

Successful exploitation can result in full takeover of the Oracle Outside In Technology component, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires an attacker to have logon access to the infrastructure and involves user interaction from a person other than the attacker. This could lead to unauthorized control and potential disruption of services relying on this technology.

Patch status is not yet confirmed — check the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit access to the infrastructure where Oracle Outside In Technology executes to trusted users only and monitor for suspicious activity involving user interactions.