A local vulnerability in the Platform component of Oracle Communications Billing and Revenue Management is a privilege escalation and access control flaw (CWE-284). The flaw enables an attacker who is already logged into the underlying infrastructure with high‑privileged access to take control of the application and its billing and revenue data. As a result, confidentiality, integrity, and availability are all compromised, and the attacker can fully take over the system.

Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are affected.

The CVSS 3.1 base score of 6.7 indicates a moderate severity with high impacts on confidentiality, integrity, and availability. The EPSS score of < 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local (AV:L) and requires high‑privileged access to the infrastructure hosting the product, so it is exploitable primarily by insiders or attackers who have compromised the underlying system. Once exploited, the attacker can fully control the application and its data.