Pricing Design Center EUVD-2026-46496

The attacker must already possess a low-privileged logon to the infrastructure where Oracle Communications Pricing Design Center executes (CVSS PR:L, AV:L) - a local, authenticated prerequisite, not remote unauthenticated access, limiting exploitation to insiders or attackers who have already gained a foothold on the PDC host. No user interaction is required (UI:N) and complexity is low (AC:L), and Oracle characterizes it as 'easily exploitable' once that logon exists. Limiting factors: only the affected On-premise Deployment versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are in scope, and the requirement for a pre-existing account on the host is the primary constraint on realistic risk. Note that the 'Authentication Bypass' tag appears to conflict with the PR:L vector and should be confirmed with the vendor.

The CVSS 3.1 base score of 7.3 (High) is driven by high confidentiality impact plus a scope change rather than by ease of remote reach. The vector is local (AV:L) with low complexity (AC:L), low privileges (PR:L, authenticated), and no user interaction, so the practical barrier is obtaining any low-privileged logon on the host where PDC runs - an insider or foothold-holding attacker rather than an anonymous internet one. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and public exploit code suggests this is not currently seeing widespread opportunistic exploitation. A key conflict to resolve: the 'Authentication Bypass' tag contradicts the PR:L in the vector - verify with Oracle whether any pre-authentication path exists, as that would materially raise urgency. Overall this is a meaningful insider and lateral-movement data-exposure risk in telecom billing environments, but not a mass-exploitation, internet-facing emergency based on available data.

An attacker who holds a low-privileged account on the server running Oracle Communications PDC - for example a disgruntled insider or an actor who gained an initial foothold - logs on locally and abuses the flaw to read all PDC-accessible pricing and customer billing data and alter some records. Because of the scope change, the same action can spill over to impact adjacent Oracle Communications products in the deployment. No public exploit code is identified at time of analysis, so this would rely on private tradecraft.