Oracle Communications Billing and Revenue Management contains a vulnerability in its Platform component that permits an unauthenticated attacker with network access over TLS to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, or total access to all data stored in the product. The CVSS score of 7.4 indicates significant confidentiality and integrity impact, with no direct availability impact.

The vulnerability affects Oracle Corporation’s Oracle Communications Billing and Revenue Management product. Versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 are all susceptible.

Exploitation requires remote network connectivity over TLS, implying the attack vector is remote over a secure channel. The absence of an EPSS score and the lack of listing in the CISA KEV catalog suggest that, while the risk level is still substantial due to the high confidentiality and integrity impact, the likelihood of widespread exploitation at this time may be moderate. Immediate mitigation is recommended to prevent potential data compromise.