← Back to search

CVE-2026-101765

9.1 CRITICAL

Published 2026-10-20 · Updated 2026-10-21

AI risk analysis

Summary
An unauthenticated attacker can exploit a vulnerability in Oracle Communications Billing and Revenue Management (BRM) Server via HTTP to gain unauthorized read access to critical data and modify or delete that data, due to missing authentication enforcement (CWE-306) and improper credential validation (CWE-287).
Exploitability
Highly exploitable by unauthenticated attackers over the network with no user interaction required.
Blast radius
Successful exploitation could lead to full compromise of billing data integrity and confidentiality across all affected BRM instances, potentially affecting financial records and customer information.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Oracle Communications Billing and Revenue Management version 15.2.0.0.0 Patch Set Update (PSU) or later, as Oracle has released patches for versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0.
auth-bypassbrmoracledata-integritydata-confidentiality

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-287, CWE-306

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.