Oracle Communications BRM - Elastic Charging Engine: Improper access control
Summary
Oracle Communications BRM - Elastic Charging Engine (ECE) version 15.2.0.0.0 is affected by a vulnerability in the Security component. An attacker with a low-privileged account and network access via TLS can create, modify or delete critical data and gain access to data accessible within ECE. Confidentiality and integrity are rated high, availability is not affected.
Affected
- Oracle Communications BRM - Elastic Charging Engine 15.2.0.0.0 (per CNA record)
- Oracle's product-level match list also includes 15.0.0.0.0, 15.0.1.0.0 and 15.1.0.0.0; not confirmed for this CVE
Fixed in
Unknown.
- Check the Oracle October 2026 Critical Patch Update advisory and the Patch Availability Document for the fixed version.
Workaround
Unknown.
- No vendor workaround found in the sources.
Exploitation
- No evidence of exploitation in the wild found; CISA KEV not checked.
- No public proof of concept found.
- EPSS 0.00326 at time of search (low).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Confirm whether Oracle Communications BRM - Elastic Charging Engine is in use and which version.
- If in use, read the Oracle October 2026 advisory and apply the fix for your version; plan this together with CVE-2026-101763 (CVSS 9.8, same advisory), which is more urgent.
- If no fix is available for your version, restrict network access to ECE management and service interfaces to known hosts, enforce strong authentication, and review low-privileged accounts.
- Monitor NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- CVE record aggregator (Vulners) vulners.com
- Oracle October 2026 CPU product list (Vulners) vulners.com
- Strix CVE summary CVE-2026-101791 www.strix.ai
- Oracle July 2026 CPU advisory (Patch Availability Document reference) www.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:23.
Original description (NVD)
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.