A flaw in the Oracle Communications Billing and Revenue Management (BRM) Server allows an unauthenticated attacker who can reach the system over TLS to perform unauthorized update, insert or delete actions and to read a subset of data, thereby compromising the confidentiality and integrity of the system. The vulnerability is exploitable over a network connection and does not require any prior authentication, making it readily achievable by external actors.

Oracle Communications Billing and Revenue Management, version 15.0.0.0.0 through 15.2.0.0.0, identified by the CPE entries for 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. All four releases are impacted.

The CVSS 3.1 base score of 6.5 indicates moderate severity, with low confidentiality and integrity impact but no availability impact. The attack vector is remote over TLS, with low complexity and no possession of privileges or user interaction required. Because this vulnerability permits unauthenticated access, it poses an elevated risk for data exposure or modification. No EPSS score is available and the vulnerability is not listed in CISA KEV, but its moderate CVSS rating and the ease of exploitation warrant immediate attention.