Oracle BRM CVE-2026-101765

The required condition is network reachability of the Oracle Communications Billing and Revenue Management BRM Server's HTTP interface; per CVSS PR:N/UI:N/AC:L the attack needs no authentication, no user interaction, and no special configuration against affected versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The primary limiting factor is exposure: BRM Servers are typically back-office telecom systems that should sit on internal/management networks rather than the public internet, so real-world reachability depends on whether the HTTP interface is exposed to the attacker's network segment. Impact is limited to confidentiality and integrity of BRM-accessible data (A:N - no availability/denial-of-service effect).

This is a genuine high-priority issue by its intrinsic metrics: the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact (no availability impact), and Oracle explicitly labels it 'easily exploitable.' However, several real-world risk signals are MISSING from the provided data: no EPSS probability score, no CISA KEV listing, and no evidence of public exploit code or SSVC decision data. The only exploitation-status signal present is the absence of all three, so this must be treated as 'no public exploit identified at time of analysis' rather than an actively exploited threat - the high CVSS reflects theoretical severity, not confirmed in-the-wild activity. No CWE is assigned, so the precise flaw class is unconfirmed; the 'Authentication Bypass' tag is consistent with PR:N but is not corroborated by the Oracle description, which states only that an unauthenticated attacker can compromise the product without naming the mechanism. Net: prioritize patching because the product handles business-critical billing/revenue data and exploitation is unauthenticated and network-based, but note that widespread opportunistic exploitation is unproven absent EPSS/KEV data.

A remote, unauthenticated attacker with network access to a BRM Server's HTTP interface sends a crafted request that bypasses access controls and reaches billing/revenue data and operations. Because no user interaction or credentials are required and attack complexity is low, the attacker can read, create, modify, or delete critical billing data. No public proof-of-concept or confirmed active exploitation is identified in the provided data.