Oracle Communications BRM Elastic Charging Engine: Authentication bypass via RMI

Summary

Oracle Communications BRM - Elastic Charging Engine, a telecom charging product, contains a flaw in its cloud native deployment that allows an unauthenticated attacker with network access via RMI to take over the product. The CVSS score is 9.8 (critical) with full confidentiality, integrity and availability impact. The NVD and CNA records classify the issue as missing authentication (CWE-287, CWE-306), while a VulDB entry describes deserialization of untrusted data (CWE-502); Oracle has not yet been verified as the source.

Affected

• Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0
• Oracle Communications BRM - Elastic Charging Engine 15.0.1.0.0
• Oracle Communications BRM - Elastic Charging Engine 15.1.0.0.0
• Oracle Communications BRM - Elastic Charging Engine 15.2.0.0.0
• Component: Cloud native deployment

Fixed in

Unknown.

Workaround

• No vendor workaround found.
• Until a patch is confirmed, restrict network access to the RMI ports to known internal hosts and keep the product off the internet.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• EPSS about 0.005 (very low predicted exploitation probability).
• CISA SSVC: Automatable yes, technical impact total.

Our recommendation

• Check whether Oracle Communications BRM - Elastic Charging Engine is installed; if not, no action needed.
• If installed, restrict RMI access to trusted internal hosts immediately and verify that it is not reachable from the internet or untrusted segments.
• Review the Oracle Critical Patch Update for October 2026 and the Patch Availability Document on My Oracle Support, and apply the fix as soon as it is available.
• Involve Oracle support to confirm the root cause and the correct fix.
• Monitor for unexpected RMI connections and patch the whole product line, including related Oracle CVEs from the same CPU.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
• NVD mirror record CVE-2026-101763 vulners.com
• Strix CVE record CVE-2026-101763 www.strix.ai
• CVEList record CVE-2026-101763 vulners.com
• VulDB entry 423544 vuldb.com
• CNNVD-2026-85993632 vulners.com
• CVE Brief archive 2026-10-21 cvebrief.com
• Oracle Critical Patch Update Advisory - January 2026 www.oracle.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:20.