The vulnerability exists in the Platform component of Oracle Communications Billing and Revenue Management. It permits a low‑privileged attacker who can log on to the underlying infrastructure to compromise the application. Successful exploitation results in the attacker taking control of the product, causing total loss of confidentiality, integrity, and availability for the affected system.

Affected product: Oracle Communications Billing and Revenue Management. Versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 are impacted.

The CVSS 3.1 base score is 7.8 indicating high severity. Exploitation requires local or credentials with low privilege on the host where the product runs and does not require user interaction. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers with access to the infrastructure could therefore take over the application with limited effort, making the risk significant for environments that expose the product to untrusted users or devices.