A flaw in the Oracle Communications Billing and Revenue Management (BRM) Server lets an unauthenticated attacker send HTTP requests to the exposed service and gain either read or write access to billing data. The vulnerability has a high confidentiality impact and a low but present integrity impact, meaning attackers can view sensitive data and also alter or delete records. The flaw is considered easily exploitable, with no need to perform additional authentication and requiring only network connectivity to the service.

The security issue affects Oracle Communications Billing and Revenue Management versions 15.0.0.0.0 through 15.2.0.0.0, specifically the BRM Server component. These versions are listed by Oracle as impacted in the October 2026 security advisory.

The CVSS 3.1 base score of 8.2 indicates a high severity vulnerability. The EPSS score is not available, and the flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote over HTTP with no authentication required, making the risk assessment high for any installation that has the BRM Server exposed to the network. Successful exploitation would allow an attacker to compromise the confidentiality and, to a lesser extent, the integrity of billing data, and could enable unauthorized update or delete operations as well. The identified CWE suggests improper access control and allows attackers to read and modify data that should be protected.