Oracle BRM EUVD-2026-106338

Exploitation requires the attacker to already have a high-privileged account with logon access to the infrastructure/host where Oracle Communications Billing and Revenue Management executes (CVSS PR:H, AV:L) - this is the primary limiting factor and makes remote or unauthenticated exploitation impossible. No user interaction is required (UI:N) and attack complexity is low (AC:L) once the local privileged foothold exists. The flaw resides in the BRM 'Platform' component and affects supported versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; no special non-default feature toggle is named in the Oracle description beyond running an affected version. The practical limiter is therefore the requirement for pre-existing privileged local access rather than any network-facing exposure.

This is a moderate-priority, not high-urgency, issue despite the HIGH-sounding 'takeover' language. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) is the dominant signal: exploitation requires LOCAL access (AV:L) to the infrastructure where Oracle Communications Billing and Revenue Management (BRM) runs AND already-high privileges (PR:H), which caps the base score at 6.7 (Medium). Full C:H/I:H/A:H impact justifies the 'takeover' characterization once those preconditions are met, but the twin gate of local logon plus high privilege makes this far from a remote, pre-auth exploitation threat. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was provided. There are no conflicting signals here - the description ('high privileged attacker with logon to the infrastructure') is consistent with the CVSS vector (AV:L/PR:H). The practical risk is that of privilege-escalation/post-compromise impact: an attacker who has already obtained a privileged foothold on the BRM host can fully compromise the application. One caveat: the input Tags label this 'Information Disclosure', which understates the actual C:H/I:H/A:H full-takeover impact described by Oracle.

An attacker who has already gained a high-privileged local account on the server hosting Oracle Communications Billing and Revenue Management (for example via a prior compromise, a malicious insider, or stolen operator credentials) abuses the vulnerable Platform component to fully take over the BRM instance, gaining complete confidentiality, integrity, and availability control. Because the CVSS vector is AV:L/AC:L, exploitation is technically straightforward once that privileged local logon exists. No public exploit code was identified at time of analysis.