The vulnerability in Oracle Communications BRM – Elastic Charging Engine enables a low‑privileged attacker with TLS network access to create, delete, or modify critical data. The defect allows unauthorized manipulation and unrestricted access to all data handled by the component, potentially compromising confidentiality and integrity. The CVSS 3.1 Base Score is 8.1, reflecting significant impact on confidentiality and integrity while lacking availability impact.

Affecting the 15.2.0.0.0 release, the product is used in enterprise billing systems. The issue is present in the Security component; any system running the affected version is vulnerable, regardless of deployment size or environment.

Because the attack requires only network connectivity and low‑privilege credentials, it is easily exploitable, especially in environments where TLS access is not restricted. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score indicates a substantial risk. Organizations should assess whether the exposure could be mitigated by disabling or hardening TLS access or by applying the vendor’s patch when it becomes available.