An unauthenticated attacker who can reach Oracle Communications Billing and Revenue Management via HTTP can trigger a defect that lets the attacker create, delete, or modify critical data. The flaw allows the attacker to compromise confidentiality and integrity of data stored in the BRM Server, potentially granting full access to all accessible data. This vulnerability is a direct route to unauthorized data manipulation and disclosure.

Oracle Communications Billing and Revenue Management, version 15.0.0.0.0 through 15.2.0.0.0, is affected. The product is supplied by Oracle Corporation, and the flaw resides in the BRM Server component.

The base CVSS score of 9.1 highlights a high severity assigned to this vulnerability. Attackers can exploit it over a network using standard HTTP traffic without authentication or a user interface. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the flaw is not yet listed in CISA’s KEV catalog. Despite this low probability, the zero‑authentication prerequisite and network accessibility suggest a realistic risk of compromise in environments without strict network segmentation or access controls.