Oracle Communications BRM CVE-2026-61091

Exploitation requires the attacker to already hold a valid local logon to the infrastructure where Oracle Communications Billing and Revenue Management executes and to have at least low-level privileges on that host (CVSS PR:L, AV:L). It affects BRM Server in versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. The key limiting factor is that the vulnerability is not remotely reachable over the network and is not unauthenticated - the attacker must first obtain a foothold on the billing host; no additional non-default feature toggle or configuration setting is named in the Oracle description, and no user interaction is required (UI:N).

Signals are moderate and internally consistent: CVSS 3.1 base score is 7.8 (High) driven by full C/I/A impact, but the attack vector is Local (AV:L) and requires existing low privileges (PR:L), which meaningfully narrows the exploitable population to users who already possess a foothold on the BRM host. AC:L and UI:N indicate that once such access exists, exploitation is reliable and requires no victim interaction. There is no EPSS score, no SSVC decision data, no CISA KEV listing, and no POC in the provided data, so there is no evidence of active or automatable exploitation - this reads as a serious-if-you-are-a-target internal escalation issue rather than a mass-exploited internet-facing threat. Note a minor inconsistency in the intelligence: the tags label this 'Information Disclosure', yet the CVSS vector and description assert full integrity and availability impact (takeover); the vector should be treated as authoritative over the tag. Priority is elevated for telecom operators running BRM 15.x because the product handles revenue-critical data, but the Local vector lowers urgency relative to a network-exploitable flaw.

An insider or an attacker who has already obtained a low-privileged shell on a BRM Server host (for example via a compromised operator or service account) runs a local exploit against the BRM Server component. With no user interaction and low attack complexity, they escalate to full control of the Oracle Communications Billing and Revenue Management instance, allowing them to read, alter or destroy billing and revenue data. No public POC is available in the provided intelligence.