The vulnerability lies in the BRM Server component of Oracle Communications Billing and Revenue Management. An unauthenticated attacker who can reach the server over HTTP can bypass normal access controls and perform unauthorized updates, inserts, or deletes, as well as read a subset of the data stored by the system. This flaw enables the attacker to modify billing and revenue data or obtain confidential information, potentially affecting the integrity and confidentiality of the system's data.

The affected product is Oracle Communications Billing and Revenue Management from Oracle Corporation. Supported versions impacted by the flaw are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. No other product lines or configurations are listed as affected in the CVE data.

The CVSS v3.1 base score of 4.8 indicates moderate severity with low confidentiality and integrity impacts under the current scoring, but the threat still lies in the fact that no authentication is required. The attack vector is network via HTTP, meaning a remote user could exploit the flaw from any location that can reach the BRM Server over HTTP. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation yet. Nevertheless its lack of authentication requirement makes it a valuable vector for attackers once they gain network access to the exposed service.