Oracle BRM CVE-2026-101807

Exploitation requires network access to an exposed Oracle Communications Billing and Revenue Management BRM Server HTTP interface by an unauthenticated attacker (PR:N, AV:N, UI:N). The decisive limiting factor is High attack complexity (AC:H) - Oracle explicitly labels this 'Difficult to exploit,' indicating the attacker must satisfy conditions outside their direct control (e.g., specific server state, configuration, or timing) rather than firing a single reliable request. Impact is bounded to unauthorized read of a subset of BRM-accessible data and unauthorized insert/update/delete to some BRM-accessible data, with no availability impact. Affected deployments are limited to BRM Server versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; the primary mitigations are restricting network exposure of the BRM HTTP interface and applying the October 2026 CPU.

This is a moderate-severity issue (CVSS 3.1 base 4.8) that should be patched on a normal cycle rather than treated as an emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) shows a network-reachable, unauthenticated flaw over HTTP, which raises exposure, but the High attack complexity (AC:H) materially tempers real-world risk - Oracle's own language 'Difficult to exploit' aligns with AC:H, implying the attacker needs specific conditions or non-trivial preparation outside their control. Impact is limited: partial confidentiality and integrity (C:L/I:L) with no availability impact (A:N), meaning unauthorized read of a subset of data and unauthorized insert/update/delete to some data, not full compromise. No EPSS score was provided, there is no CISA KEV listing, and no public POC was identified, so all three exploitation-likelihood signals are either absent or negative; nothing in the data suggests active or imminent exploitation. No SSVC decision data was supplied. The one notable tension is the input tag 'Authentication Bypass,' which is not supported by the description (the description describes an unauthenticated attacker and limited CRUD/read impact, not a bypass of an authentication control) - treat that tag as unverified. Overall this reads as a genuine but low-priority vulnerability, not a high-CVSS-but-hollow finding nor an urgent one.

A remote unauthenticated attacker reaches an exposed BRM Server HTTP interface and sends crafted requests that, under specific hard-to-meet conditions (AC:H), trigger unauthorized read of a subset of billing/revenue data and unauthorized insert, update, or delete of some accessible data. No public exploit code was identified at the time of analysis, and the High attack complexity means reliable exploitation likely requires specialized knowledge of the target deployment or timing/race conditions.