Oracle BRM Elastic Charging Engine Has Critical RMI Flaw
A critical vulnerability in Oracle’s Elastic Charging Engine allows unauthenticated remote takeover via RMI, affecting four specific cloud-native versions.
Key points
- CVE-2026-101763 carries a CVSS score of 9.8, rated critical.
- The flaw allows unauthenticated attackers with network access to take over the system.
- Versions 15.0.0.0.0 through 15.2.0.0.0 are affected by this remote code execution risk.
Oracle Communications BRM - Elastic Charging Engine contains a critical vulnerability that enables unauthenticated attackers to take over the system via Remote Method Invocation. The flaw, identified as CVE-2026-101763, is easily exploitable and requires only network access to compromise the cloud-native deployment component.
The National Vulnerability Database rates the issue with a CVSS 3.1 Base Score of 9.8, classifying it as critical. Successful exploitation results in high impacts to confidentiality, integrity, and availability. The vector indicates that no user interaction or privileged access is needed for the attack to succeed.
Context and Background
The vulnerability resides specifically within the cloud-native deployment component of the Oracle Communications BRM - Elastic Charging Engine product. According to the NVD record, the weakness allows an attacker with network access to compromise the engine through RMI protocols.
The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the low complexity and lack of required privileges. This means the attack surface is broad for any instance exposed to a network where RMI traffic is permitted.
Who Is Affected
Four specific supported versions of the software are affected by this vulnerability. Users running version 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are exposed to this risk. Organizations using these cloud-native deployments must verify their current version against this list immediately.
No other versions are listed as affected in the available data. The scope is limited to these four releases of the Elastic Charging Engine. Enterprises managing multiple environments should audit their installations to ensure none of these specific version strings are in active production.
What should you do?
Since no patch or fix has been confirmed yet in the source material, immediate mitigation relies on network segmentation. Administrators should restrict access to RMI ports to trusted networks only. Monitoring for unusual RMI traffic can help detect exploitation attempts before full takeover occurs.
What to do and how to stay safe: Oracle
- Audit your Oracle Communications BRM installations to check if you are running versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, or 15.2.0.0.0.
- Implement network access controls to block untrusted traffic from reaching RMI ports on servers hosting the Elastic Charging Engine.
- Monitor server logs for unauthorized RMI connections or unusual system activity that could indicate an exploitation attempt.
- Wait for official vendor guidance before applying any unverified third-party patches or configuration changes to avoid system instability.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle product is affected by CVE-2026-101763?
The Oracle Communications BRM - Elastic Charging Engine product, specifically its cloud-native deployment component, is affected.
What is the severity of this vulnerability?
The vulnerability has a CVSS 3.1 Base Score of 9.8, which is rated as critical.
Does this flaw require authentication to exploit?
No, the vulnerability allows an unauthenticated attacker with network access via RMI to compromise the system.
