CVE-2026-101763
CriticalCVSS 9.8Summary
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product (component: Cloud native deployment) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. An unauthenticated attacker with network access via RMI can easily exploit it to take over Elastic Charging Engine.
Risk Assessment
A critical CVSS 9.8 score indicates high risk of full component takeover, potentially leading to confidentiality, integrity, and availability breaches. The attack is remote and requires no authentication.
Recommendation
Immediately apply Oracle security updates. Restrict network access to the RMI service and monitor for unusual activity.
Other vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
See all- CVE-2026-101793Medium
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component Core) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable by a low-privileged attacker with logon to the infrastructure, allowing unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-101792Medium
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component Security) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit, it allows an unauthenticated attacker with access to the physical communication segment to create, delete or modify critical data and read a subset of accessible data.
- CVE-2026-101791High
Vulnerability in Oracle Communications BRM - Elastic Charging Engine (component: Security) affecting version 15.2.0.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via TLS to create, delete or modify critical data and gain full access to all accessible data.
- CVE-2026-101790Low
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product (component: Security) affecting versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An easily exploitable vulnerability allows a low privileged attacker with logon to the infrastructure to gain unauthorized read access to a subset of Elastic Charging Engine accessible data.
- CVE-2026-61053High
Vulnerability in Oracle Communications BRM - Elastic Charging Engine. A low-privileged attacker with local access can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS