Oracle Billing System Flaw Allows Unauthenticated Data Manipulation
A critical vulnerability in Oracle Communications Billing and Revenue Management permits unauthenticated attackers to modify or delete critical data via HTTP.
Key points
- Oracle Communications Billing and Revenue Management versions 15.0.0.0.0 through 15.2.0.0.0 are affected.
- The National Vulnerability Database rates the flaw CVSS 9.1, classifying it as critical.
- Attackers can create, delete, or modify data without authentication using network access.
The National Vulnerability Database lists CVE-2026-101765 as a critical security flaw in Oracle Communications Billing and Revenue Management. This vulnerability allows unauthenticated attackers with network access to compromise the system via HTTP protocols without any user interaction.
According to the NVD record, the issue carries a CVSS 3.1 Base Score of 9.1. The weakness affects the BRM Server component within the Oracle Communications product suite. Successful exploitation results in high impacts to both confidentiality and integrity, with no impact on availability.
Technical Details and Impact
The vulnerability is described as easily exploitable by an attacker who has network access to the targeted system. The CVSS vector indicates that the attack is network-accessible, requires low complexity, no privileges, and no user interaction. This configuration makes the flaw particularly dangerous for exposed server instances.
An attacker who successfully exploits this vulnerability can gain unauthorized access to critical data. The NVD record states that attackers can also create, delete, or modify access to all data accessible to the Oracle Communications Billing and Revenue Management system. This includes complete access to all accessible data within the application.
Affected Software Versions
The NVD record identifies specific supported versions of the Oracle Communications Billing and Revenue Management product that are vulnerable. These include versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. Organizations using any of these specific version strings should verify their exposure immediately.
No other product lines or major version releases are mentioned in the current advisory. The flaw is isolated to the BRM Server component within these specific updates. That suggests the issue stems from a specific implementation in the server’s handling of HTTP requests during these release cycles.
What should you do?
Organizations should audit their network logs for unusual HTTP traffic directed at their BRM Server components. Security teams should verify which versions of Oracle Communications Billing and Revenue Management are currently deployed in their environments. Until further guidance is available, strict network segmentation is recommended to limit external access to the server.
What to do and how to stay safe: Oracle
- Inventory your environment to confirm if BRM Server versions 15.0.0.0.0 through 15.2.0.0.0 are installed.
- Monitor HTTP traffic logs for unauthorized access attempts or data modification requests.
- Restrict network access to the BRM Server to trusted internal networks only.
- Wait for official vendor patches or mitigation instructions before applying unverified changes.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-101765?
The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.1, classifying the vulnerability as critical.
Which versions of Oracle Communications BRM are affected?
Versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are identified as affected in the NVD record.
Can an attacker exploit this without authentication?
Yes, the vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system.
