Oracle BRM CVE-2026-91627

Exploitation requires the attacker to have interactive logon access to the infrastructure host where Oracle Communications Billing and Revenue Management executes and to hold at least low-level privileges (PR:L) on that system; it targets the Platform component of BRM versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The key limiting factor is that this is local-only (AV:L) - it is not reachable over the network and provides no path for an unauthenticated remote attacker - so realistic risk depends on how tightly local/shell access to BRM hosts is controlled. No special non-default feature or configuration is named in the description; once local low-privileged access exists, attack complexity is low and no user interaction is required.

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw: the attacker must already have logon access to the infrastructure where Oracle Communications Billing and Revenue Management (BRM) runs and hold low privileges (PR:L), after which full compromise (C:H/I:H/A:H, 'takeover') is achievable with low complexity and no user interaction. This is an authenticated local privilege-escalation / takeover rather than a remotely reachable issue - AV:L materially lowers mass-exploitation potential versus a network-facing bug of the same score. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuinely serious bug for anyone running affected BRM versions, but its real-world priority is bounded by the local-access prerequisite - it is a patch-in-next-cycle issue for exposed operators rather than an emergency network-exploitable threat. Note a conflict to verify: the input Tags label this 'Information Disclosure,' yet the description and vector indicate full takeover (I:H/A:H), so the impact is broader than information disclosure alone.

An attacker who already has a low-privileged local account on the server hosting Oracle Communications BRM (e.g., a limited operator shell or a compromised low-tier service account) leverages the Platform component flaw to escalate to full control of the BRM instance. No user interaction or additional privileges are needed, and the low attack complexity means exploitation is reliable once local logon is obtained. No public exploit code was identified at time of analysis.