Elastic Charging Engine EUVD-2026-106194

Exploitation requires the attacker to already possess a low-privileged logon to the infrastructure/host where Oracle Communications BRM - Elastic Charging Engine executes (AV:L, PR:L) - this is not remotely reachable and not unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local authenticated access exists, exploitation is straightforward. Limiting factors: the requirement for existing local accounts and credentials on the ECE host confines the threat to insiders or attackers who have already established a foothold, and only the four listed 15.x versions are affected. Impact is confined to confidentiality (C:H; I:N/A:N) - unauthorized read access to ECE-accessible data, with no integrity or availability impact.

This is a moderate-severity confidentiality issue, not a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) tells a consistent story: exploitation requires LOCAL access (the attacker must already have a logon to the infrastructure where ECE runs) and at least low-level privileges, which caps the real-world severity despite the HIGH confidentiality impact. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC was supplied, so there is no public exploit identified at time of analysis. The signals do not conflict - they uniformly point to a low-to-moderate, insider/foothold-dependent risk rather than a wormable or internet-facing threat. The main caveat is a metadata conflict: the input Tags include 'Authentication Bypass,' which contradicts the vector's PR:L (exploitation requires an authenticated low-privileged logon, not a bypass) and the description's own wording - verify the vulnerability class with Oracle's advisory, as the tag appears mislabeled. Overall: a real but not urgent issue for organizations running the affected ECE 15.x versions, best prioritized where untrusted or semi-trusted users have local access to the charging infrastructure.

An attacker who already holds a low-privileged local account on the server hosting Oracle Communications BRM - Elastic Charging Engine abuses the flaw in the Core component to read data they should not be able to access. Because the attack vector is local and requires existing logon and privileges, the realistic actor is a malicious insider or an adversary who has already gained a foothold on the host. No public exploit code is known at time of analysis.