Elastic Charging Engine EUVD-2026-106192

Exploitation requires network access to the Oracle Communications BRM Elastic Charging Engine over TLS plus a low-privilege authenticated foothold (PR:L) - a valid account or session on the ECE instance - targeting the Security component; no user interaction is needed (UI:N) and Oracle rates it easily exploitable (AC:L) against supported version 15.2.0.0.0. The principal limiting factor is the authentication requirement: an unauthenticated external attacker cannot exploit this directly, so risk is concentrated where low-privilege ECE access is broadly granted or where an attacker can first obtain such credentials. Impact is limited to confidentiality and integrity of ECE-accessible data; there is no availability/denial-of-service impact (A:N).

This is a genuinely high-priority vulnerability per its signals, though not a drop-everything emergency. The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high confidentiality AND integrity impact (C:H/I:H) but no availability impact (A:N) - consistent with a data-exposure/data-tampering flaw rather than a crash or RCE. Oracle explicitly characterizes it as 'easily exploitable,' which aligns with AC:L. However, the PR:L metric means an attacker must already hold some authenticated foothold (a valid low-privilege account or session) on the ECE instance, which materially narrows the realistic attacker population versus a PR:N flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' NOTE A CONFLICT: the Tags list 'Authentication Bypass,' but the CVSS vector specifies PR:L (authentication required), and an authentication-bypass primitive would normally be scored PR:N - this tag appears inconsistent with the vendor's own vector and should be verified against the Oracle CPU advisory rather than treated as confirmed. Overall: a real priority to patch in affected Oracle Communications BRM ECE deployments, but the PR:L prerequisite and absence of KEV/EPSS/POC signals place it below internet-facing unauthenticated criticals.

An attacker who has obtained low-privilege credentials or a valid session on an Oracle Communications BRM Elastic Charging Engine instance connects over the network via TLS and abuses the Security-component flaw to read, create, modify, or delete critical charging/billing data beyond their authorization level. Because Oracle rates it 'easily exploitable' (AC:L) with no user interaction, a single authenticated request may suffice. No public exploit code was identified at the time of analysis, so exploitation would require independent development.