Elastic Charging Engine EUVD-2026-106191

Requires the attacker to already possess a low-privileged account with logon access to the infrastructure/host where Oracle Communications BRM - Elastic Charging Engine executes (PR:L, AV:L) - it is NOT remotely or network-exploitable. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited to one of the listed affected versions (15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) and yields only unauthorized read access to a subset of ECE data, with no write or availability impact. The key limiting factors defenders can rely on are the local-access and prior-authentication requirements, which confine realistic risk to insiders or an attacker who has already compromised the server.

This is a low-severity issue that is not a patching priority on its own. The CVSS 3.1 base score is 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires local logon to the infrastructure where the Elastic Charging Engine runs, already-held low-level privileges (PR:L), low attack complexity, and no user interaction; impact is limited to unauthorized read of a subset of data (C:L) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active or probable exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (low score, local vector, authenticated precondition, confidentiality-only), with no conflict between the description and the CVSS vector. Note a likely metadata conflict: the input tag 'Authentication Bypass' contradicts the vulnerability itself, which requires an authenticated low-privileged logon (PR:L) and yields only partial read access - it is not an authentication bypass. Overall this is a genuinely low-risk, low-priority finding best handled in normal Oracle Critical Patch Update cycles rather than as an emergency.

A low-privileged user who already has a valid logon to the host running Oracle Communications BRM - Elastic Charging Engine abuses the flaw to read a subset of data in the Security component that should be outside their authorization. Because the vector is local (AV:L) with low complexity and no user interaction, a malicious insider or an attacker who has already gained a foothold on the server can trigger it reliably. No public exploit code is known at time of analysis.