A local vulnerability in Oracle Communications Billing and Revenue Management allows a low‑privileged attacker who can log on to the infrastructure that runs the product to compromise the application. Successful exploitation can lead to unauthorized access to critical data or complete access to all data stored or transmitted by the application. The vulnerability is defined by a CVSS 3.1 base score of 4.7 with an impact vector of Confidentiality High and no impact on Integrity or Availability.

The flaw affects Oracle Corporation’s Oracle Communications Billing and Revenue Management product. Supported affected versions include 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0.

The CVSS score indicates a moderate risk with Confidentiality as the only affected property. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited in the wild. Exploitation requires local access, and the attacker must already have a low‑privileged account on the underlying host. The lack of remote vectors reduces the overall threat, though the potential to read sensitive billing data makes this a concern for environments storing confidential customer or financial information.