What is the CVSS score of CVE-2026-61053?

CVE-2026-61053 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Communications BRM are affected by CVE-2026-61053?

Oracle Communications BRM Elastic Charging Engine (versions 15.0.0-15.2.0) contains a privilege escalation vulnerability that allows authenticated users with host access to achieve complete…

How to fix or mitigate CVE-2026-61053?

Within 24 hours, inventory all systems running Oracle Communications BRM ECE versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, or 15.2.0.0.0 and identify which support production billing operations. Within 7 days, implement compensating controls: restrict host-level logon access for low-privileged users on ECE infrastructure, deploy privileged activity monitoring on all ECE systems, and establish network segmentation isolating Diameter Gateway and SDK components from untrusted network segments. Within 30 days, escalate to Oracle support to confirm patch availability timelines and develop a formal remediation roadmap including version upgrade schedules or architectural alternatives to reduce exposure.

Oracle Communications BRM CVE-2026-61053

EUVD-2026-47267 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-32j3-45v6-3gwp

Oracle Elastic Privilege Escalation Communications Billing And Revenue Management Elastic Charging Engine

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Description states low-privileged local logon required (AV:L, PR:L) with easy exploitation (AC:L) and full product takeover, giving C:H/I:H/A:H and scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:04 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Diameter Gateway and SDK). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

The affected product is Oracle's Elastic Charging Engine (ECE), the real-time online charging component of the Oracle Communications Billing and Revenue Management (BRM) suite used by telecom carriers to rate and charge for subscriber usage. The specific component is the Diameter Gateway and SDK - the Diameter protocol front-end (RFC 6733, used for online charging via the Ro/Gy interfaces between network elements and the charging system) plus its developer SDK. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., improper access control, insecure deserialization, or privilege management flaw) cannot be confirmed from the available data; the CVSS local vector with low-privilege prerequisite suggests a flaw exploitable by an existing OS/application account on the ECE host rather than over the Diameter network interface itself.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships ECE security fixes through the quarterly CPU rather than as standalone tagged releases, so consult that advisory for the exact patch/bundle applicable to your 15.0.x, 15.1, or 15.2 deployment (Patch available per vendor advisory; an exact fix version is not enumerated in the provided input). Because exploitation requires a local low-privileged logon, effective compensating controls until patching include restricting and auditing interactive/OS and application accounts on the hosts running ECE and the Diameter Gateway (reduce the population of low-privilege accounts that could exploit the flaw), enforcing least privilege and separation of duties on the charging infrastructure, and monitoring for anomalous local activity by service accounts - with the trade-off that these reduce but do not eliminate insider or foothold-based risk and require operational review to avoid disrupting legitimate integration/SDK usage.