Description
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data as well as unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and read
Action: Apply patch
AI Analysis

Impact

A flaw in the Oracle Communications Billing and Revenue Management (BRM) Server allows an unauthenticated attacker who can reach the system over TLS to perform unauthorized update, insert, or delete actions and to read a subset of data, thereby compromising the confidentiality and integrity of the system.

Affected Systems

Oracle Communications Billing and Revenue Management, versions 15.0.0.0.0 through 15.2.0.0.0, as identified by the listed CPE entries. All four releases are impacted.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates moderate severity, with low confidentiality and integrity impact but no availability impact. The attack vector is remote over TLS, with low complexity and no possession of privileges or user interaction required. Because this vulnerability permits unauthenticated access, it poses an elevated risk for data exposure or modification. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV, but its moderate CVSS rating and the ease of exploitation warrant immediate attention.

Generated by OpenCVE AI on November 6, 2026 at 21:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Customer Updates October 2026 patch that fixes the vulnerability
  • If the patch is not yet available, restrict external TLS access to the BRM Server using firewalls or network segmentation to limit exposure to trusted hosts
  • Review and enforce proper authentication and authorization controls to ensure only legitimate users can perform data modifications or read operations

Generated by OpenCVE AI on November 6, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Retrieval via Unauthenticated TLS Access in Oracle Communications BRM

Fri, 06 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification and Read via TLS in Oracle BRM Server
Weaknesses CWE-284
CWE-287

Fri, 06 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification and Read via TLS in Oracle BRM Server
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data as well as unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle communications Billing And Revenue Management
CPEs cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.1.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.2.0.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle communications Billing And Revenue Management
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Communications Billing And Revenue Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T17:39:14.936Z

Reserved: 2026-09-28T15:40:09.494Z

Link: CVE-2026-101606

cve-icon Vulnrichment

Updated: 2026-11-06T17:34:03.286Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-20T22:18:14.313

Modified: 2026-11-06T18:17:35.870

Link: CVE-2026-101606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T21:45:10Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function