Vulnerability in Oracle Communications Billing and Revenue Management (BRM Server) allows a low‑privileged local attacker to compromise the system and gain unauthorized access to critical data. The flaw can be triggered by an attacker with a logon to the infrastructure where BRM runs. Successful exploitation results in confidentiality loss, with the attacker able to read or modify all data that the BRM Server manages. The CVSS 3.1 base score of 5.5 reflects a local attack vector (AV:L) with low authentication and minimal privileges (AC:L/PR:L) but a high impact on confidentiality.

Oracle Communications Billing and Revenue Management, versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 are affected. No other versions are reported as vulnerable.

The vulnerability is classified as moderate severity (CVSS 5.5) and is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified. The attack requires a local presence and low privileges, which limits the potential for widespread compromise to environments where such accounts exist. Nonetheless, the high confidentiality impact warrants timely patching.