CVE-2026-101791
HighCVSS 8.1Summary
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component: Security) affecting version 15.2.0.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via TLS to create, delete or modify critical data and gain full access to all accessible data.
Risk Assessment
An attacker with basic privileges can compromise the confidentiality and integrity of critical billing data, potentially leading to financial fraud and data leakage.
Recommendation
Immediately apply the security update provided by Oracle for version 15.2.0.0.0 and restrict network access to the component.
Other vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
See all- CVE-2026-101793Medium
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component Core) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable by a low-privileged attacker with logon to the infrastructure, allowing unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-101792Medium
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component Security) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit, it allows an unauthenticated attacker with access to the physical communication segment to create, delete or modify critical data and read a subset of accessible data.
- CVE-2026-101790Low
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product (component: Security) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An easily exploitable vulnerability allows a low privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of Elastic Charging Engine accessible data.
- CVE-2026-101763Critical
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product (component: Cloud native deployment) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. An unauthenticated attacker with network access via RMI can easily exploit it to take over Elastic Charging Engine.
- CVE-2026-61053High
Vulnerability in Oracle Communications BRM - Elastic Charging Engine. A low-privileged attacker with local access can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS