Description
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation leading to Full Application Compromise
Action: Patch Now
AI Analysis

Impact

The vulnerability is a local, high‑privilege flaw that allows an attacker with authentic access to the host infrastructure to compromise the Oracle Communications Billing and Revenue Management application. Successful exploitation can lead to full takeover of the application, impacting confidentiality, integrity, and availability as reflected in the CVSS v3.1 base score of 6.7. The flaw maps to CWE‑269 (improper authorization).

Affected Systems

The affected product is Oracle Communications Billing and Revenue Management from Oracle Corporation. Versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are impacted.

Risk and Exploitability

The CVSS v3.1 base score is 6.7, indicating a medium‑to‑high severity. The EPSS score is < 1%, so the probability of exploitation is unclear. The vulnerability is not listed in CISA’s KEV catalog. Based on the vector (local access, high privileges), the attack requires an authenticated user or one with elevated host rights, but once achieved it can take over the entire application.

Generated by OpenCVE AI on October 28, 2026 at 01:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the October 2026 security advisory for versions 15.0.0.0.0 through 15.2.0.0.0
  • Configure the Oracle Communications Billing and Revenue Management service to run under an account with the minimum privileges required, removing any unnecessary administrative rights on the host OS
  • Enable audit logging for privileged account usage and monitor for anomalous activity, such as unexpected process execution or configuration changes, to detect exploitation attempts early.

Generated by OpenCVE AI on October 28, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title High-Privilege Local Vulnerability in Oracle Communications Billing and Revenue Management Leading to Full Application Compromise

Wed, 28 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Enabling Full Application Compromise in Oracle Communications Billing and Revenue Management
Weaknesses CWE-284

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Thu, 22 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Enabling Full Application Compromise in Oracle Communications Billing and Revenue Management
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle communications Billing And Revenue Management
CPEs cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.1.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.2.0.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle communications Billing And Revenue Management
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Communications Billing And Revenue Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T19:07:19.403Z

Reserved: 2026-09-08T21:49:12.409Z

Link: CVE-2026-87297

cve-icon Vulnrichment

Updated: 2026-10-27T19:07:10.218Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:06.737

Modified: 2026-10-27T19:17:31.890

Link: CVE-2026-87297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses
  • CWE-269

    Improper Privilege Management