An unauthenticated attacker can exploit a flaw in the Oracle Communications Billing and Revenue Management (BRM) Server via an HTTP request to gain access to critical data, potentially allowing full compromise of all accessible data. The vulnerability delivers a confidentiality impact with a CVSS v3.1 Base Score of 7.5, indicating a high confidentiality impact and no integrity impact.

The affected product is Oracle Corporation’s Oracle Communications Billing and Revenue Management (BRM Server), specifically versions 15.0.0.0.0 through 15.2.0.0.0. These are the only versions listed as vulnerable.

The CVSS score indicates a moderate to high severity. The EPSS score of < 1 % indicates a very low probability of exploitation based on current threat data. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. The attack vector is network‑based (HTTP) and requires no authentication, as shown by the CVSS vector; exploitation would enable an attacker to read all data accessible by the BRM Server, resulting in a confidentiality breach.