Oracle BRM CVE-2026-91628

Exploitation requires the attacker to already hold a valid low-privileged logon to the infrastructure/host where Oracle Communications Billing and Revenue Management (BRM Server component) runs - per CVSS AV:L and PR:L, this is a local, authenticated prerequisite, not remote unauthenticated access. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local authenticated access exists, exploitation is straightforward. Limiting factors that reduce real-world risk: the need for prior logon access to BRM infrastructure, the authenticated privilege requirement, and the restriction of affected deployments to BRM versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; impact is confined to confidentiality (data disclosure) with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw, not a top-tier emergency. The CVSS 3.1 base score of 5.5 is driven entirely by a high confidentiality impact (C:H) with no integrity or availability effect (I:N/A:N), and the vector is constrained: AV:L means the attacker must already have local logon access to the infrastructure where BRM executes, AC:L indicates the attack itself is easy once that foothold exists, and PR:L means low-level authenticated access is required (so this is an authenticated/local-privilege issue, not remote-unauthenticated). No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence, so by the available signals this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. The combination - local vector plus required privileges plus confidentiality-only impact - places this below internet-facing RCE/KEV-class issues in priority. One data conflict should be noted: the input tag 'Authentication Bypass' does not match the CVSS vector, which explicitly requires PR:L (an authenticated low-privileged user); a true authentication bypass would normally present as PR:N, so the tag appears mislabeled and should not be treated as confirmed. Patch availability is via the Oracle Critical Patch Update of October 2026; defenders should apply it on a normal risk-prioritized schedule given the local/authenticated constraints.

A low-privileged user who already has a legitimate logon to the host or infrastructure running Oracle Communications Billing and Revenue Management abuses the BRM Server component to read billing and revenue data they are not authorized to see. Because the attack complexity is low once local access is held, the attacker can reliably retrieve critical or all BRM-accessible data (confidentiality compromise only), though no public exploit code was identified at the time of analysis.