Oracle Communications BRM CVE-2026-61053

Exploitation requires the attacker to already have a low-privileged logon (PR:L) to the infrastructure host where Oracle Communications BRM - Elastic Charging Engine executes, and to interact with the Diameter Gateway and SDK component; the CVSS local vector (AV:L) means it cannot be triggered purely over the network without such a foothold. Limiting factors: authenticated access is required (PR:L, not PR:N), the attack is local rather than remote, and it applies to ECE versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a low-privilege foothold exists there are no further special configuration conditions stated in the description.

The CVSS 3.1 base score of 7.8 (High) is driven by full C/I/A compromise (scope unchanged) combined with a local attack vector (AV:L), low complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N). This is a genuine post-authentication local privilege escalation / takeover risk rather than a remotely-wormable threat: an attacker must already have a valid low-privileged logon to the ECE infrastructure, which meaningfully limits the exposure to insiders, compromised service accounts, or attackers who have already gained a foothold. No EPSS score is provided in the input, KEV status is not confirmed (not listed), and no POC is referenced - so there is no signal of active or automated exploitation. The 'Information Disclosure' tag is narrower than the description's full-takeover claim; the description and CVSS (C:H/I:H/A:H) are authoritative here, indicating impact well beyond disclosure. Priority should be assessed as important-but-not-emergency for defenders: patch in the normal Oracle CPU cycle, prioritized where untrusted or numerous low-privilege accounts exist on ECE hosts.

An attacker who has obtained a low-privileged account on an ECE host - for example a compromised service or integration account, or a malicious insider - leverages the Diameter Gateway and SDK flaw to escalate from that limited access to full control of the Elastic Charging Engine, enabling manipulation of charging/billing data and disruption of the online charging service. No public proof-of-concept is identified at time of analysis, and the local low-complexity vector means that once such access exists, exploitation is straightforward.