Oracle BRM EUVD-2026-106165

Exploitation requires the attacker to already have a local logon account with low privileges (PR:L) on the infrastructure host where Oracle Communications Billing and Revenue Management executes, and to be able to interact with the BRM Server component; it cannot be performed remotely over the network (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local authenticated access exists, exploitation is straightforward. Limiting factors that reduce real-world risk: the mandatory pre-existing authenticated local foothold, the absence of any integrity or availability impact (I:N/A:N - read-only data disclosure), and affected scope restricted to Oracle BRM versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0.

This is a moderate-severity confidentiality issue (CVSS 3.1 base 5.5) whose real-world urgency is tempered by its access requirements. The vendor-supplied vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates exploitation requires LOCAL access (AV:L) - a logon to the infrastructure where Oracle BRM runs - plus existing low-level privileges (PR:L), with no user interaction and low attack complexity. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read all BRM-accessible data but cannot modify data or disrupt availability. There is no CISA KEV listing, no EPSS score provided, and no public proof-of-concept identified in the supplied data, so no public exploit identified at time of analysis. The description's phrase 'easily exploitable' aligns with AC:L but does NOT imply remote or unauthenticated access - the local vector and PR:L requirement are the dominant limiting factors. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' is inconsistent with the CVSS vector, which explicitly requires authenticated low-privileged logon (PR:L) rather than bypassing authentication - verify the tag against Oracle's advisory. Overall this is a real but not top-tier priority: credible for a malicious insider or an attacker who has already gained a foothold, but not a drive-by remote threat.

A low-privileged user who already holds a local logon to the host running Oracle Communications Billing and Revenue Management abuses a flaw in the BRM Server component to read critical billing and subscriber data they should not be able to access. Because attack complexity is low (AC:L) and no user interaction is needed, a malicious insider or an attacker who has pivoted onto the billing host can reliably extract confidential data. No public exploit code is identified at time of analysis, so exploitation would require independent development.