{"id":"CVE-2026-101765","published":"2026-10-20T22:18:31.833","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated attacker can exploit a vulnerability in Oracle Communications Billing and Revenue Management (BRM) Server via HTTP to gain unauthorized read access to critical data and modify or delete that data, due to missing authentication enforcement (CWE-306) and improper credential validation (CWE-287).","exploitability":"Highly exploitable by unauthenticated attackers over the network with no user interaction required.","blast_radius":"Successful exploitation could lead to full compromise of billing data integrity and confidentiality across all affected BRM instances, potentially affecting financial records and customer information.","remediation":"Upgrade to Oracle Communications Billing and Revenue Management version 15.2.0.0.0 Patch Set Update (PSU) or later, as Oracle has released patches for versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","brm","oracle","data-integrity","data-confidentiality"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:47:53.723Z"}}