The vulnerability in Oracle Communications BRM – Elastic Charging Engine permits a low‑privileged user who can log on to the target infrastructure to read a subset of data that should normally be restricted, thereby exposing confidential information. No code execution or integrity/availability impact is described; the attack results solely in a confidentiality breach as reflected in the CVSS vector, which includes a low confidentiality impact (C: L) and no impact to integrity or availability.

Affected products are Oracle Communications BRM – Elastic Charging Engine version 15.0.0.0.0 through 15.2.0.0.0. These releases are identified in the official vendor advisory and are listed in the provided CPE strings.

The CVSS score of 3.3 indicates a low severity confidentiality risk, and the EPSS score is not reported. Because the attack requires local access to the infrastructure that hosts the application, the likely attack vector is local. The vulnerability is not catalogued in CISA’s KEV list, so there are no known active exploits documented at the time of this analysis. The overall risk is low, but if an attacker already has legitimate logon rights, they can use the flaw to exfiltrate sensitive subset data.