Elastic Charging Engine EUVD-2026-106164

Exploitation requires network reachability to the Oracle Communications BRM Elastic Charging Engine's Java RMI interface in a cloud-native deployment; per CVSS PR:N/UI:N no authentication or user interaction is needed, so any actor who can route to the RMI port can attempt it against affected versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The primary LIMITING factor is network exposure: ECE RMI endpoints are normally deployed inside segmented telecom operator back-office/OSS-BSS networks rather than internet-facing, so realistic risk hinges on whether the RMI listener is reachable from untrusted segments. No special product feature toggle is named in the description beyond the RMI-based cloud-native deployment component itself.

All exploitability signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully network-reachable, low-complexity, and requires no privileges or user interaction, which Oracle reinforces by describing it as 'easily exploitable' by an 'unauthenticated attacker' resulting in complete 'takeover' - consistent with the C:H/I:H/A:H impact and 9.8 base score. The attack surface is Java RMI, a protocol historically prone to unauthenticated deserialization-to-RCE abuse, which raises real-world concern. However, several corroborating signals are ABSENT from the provided data: no EPSS probability was supplied, the vulnerability is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only references are the Oracle October 2026 CPU advisory and the NVD mirror; no independent technical write-up is present. Net: the intrinsic risk is high (pre-auth network RCE/takeover in a product typically exposed only within telecom operator back-office networks), but the likelihood signals (EPSS/KEV/POC) are currently unpopulated, so this is a patch-urgently-but-not-yet-known-exploited case rather than a confirmed in-the-wild threat. Note also a tag/impact mismatch: the input tag 'Information Disclosure' understates a vulnerability Oracle describes as full takeover affecting confidentiality, integrity, AND availability.

An attacker with network reachability to the Elastic Charging Engine's exposed Java RMI listener sends a crafted RMI request (e.g., a malicious serialized object) without any credentials or user interaction. Because the flaw allows low-complexity unauthenticated exploitation, the attacker gains full control (takeover) of the ECE instance, compromising billing/charging data and service availability. No public proof-of-concept is referenced, but the RMI vector and pre-auth nature make exploitation straightforward once an exploit is developed.