What is the CVSS score of CVE-2026-61091?

CVE-2026-61091 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Communications BRM are affected by CVE-2026-61091?

Oracle Communications Billing and Revenue Management (BRM Server) contains a privilege escalation vulnerability affecting versions 15.0-15.2, enabling any internal user with system access to gain…

How to fix or mitigate CVE-2026-61091?

Within 24 hours, identify all production and non-production systems running BRM Server versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, or 15.2.0.0.0 and assess the population of users with logon access to those systems. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected instances, prioritizing production billing systems and conducting thorough testing in staging environments before deployment. Within 30 days, complete patching across all systems, review and restrict logon access to essential personnel only, and audit system logs for any suspicious privilege escalation attempts occurring between discovery and patch application.

Oracle Communications BRM CVE-2026-61091

EUVD-2026-47302 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-c2q8-xvvx-f29v

Oracle Privilege Escalation Communications Billing And Revenue Management

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires existing local logon with low privileges on the BRM host (AV:L, PR:L), reliable once present (AC:L, UI:N), yielding full product takeover so C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:52 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation leading to full product takeover affects the BRM Server component of Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. A low-privileged attacker who already has a logon on the host where BRM executes can leverage this easily-exploitable flaw to fully compromise the product, gaining high impact to confidentiality, integrity and availability. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild; Oracle addressed it in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Communications Billing and Revenue Management (BRM) is an enterprise convergent charging and billing platform used by telecommunications carriers; the affected BRM Server is the core back-end that processes rating, billing and account management logic. The CVSS vector (AV:L) indicates the weakness is reachable only by a principal with local logon to the infrastructure, and the S:U (unchanged scope) with full C/I/A impact implies the flaw allows an authenticated local user to escalate control over the BRM application/service context itself rather than crossing into a separate security authority. No CWE was supplied by Oracle or NVD, so the precise weakness class (e.g., improper access control, insecure file/permission handling, or injection) cannot be stated with certainty; Oracle's advisory-style description characterizes the outcome as complete 'takeover' of the product.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not include a discrete fixed build number, so administrators should follow the CPU matrix for the exact patch corresponding to their installed BRM 15.x release. Because exploitation requires local logon (AV:L, PR:L), the most effective compensating control until patching is to tightly restrict and audit interactive/OS-level access to the BRM Server hosts: limit accounts that can log on to the billing infrastructure, enforce least privilege on BRM service and application accounts, and monitor for anomalous local activity by low-privileged users. These access restrictions have low functional side effects but require operational discipline around account provisioning; they reduce but do not eliminate risk, so patching remains the primary fix.