Oracle Communications BRM 15.0.0.0.0/15.0.1.0.0/15.1.0.0.0/15.2.0.0.0 Core improper authorization

Summaryinfo

A vulnerability identified as problematic has been detected in Oracle Communications BRM 15.0.0.0.0/15.0.1.0.0/15.1.0.0.0/15.2.0.0.0. The impacted element is an unknown function of the component Core. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-101793. The attack needs to be performed locally. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Oracle Communications BRM 15.0.0.0.0/15.0.1.0.0/15.1.0.0.0/15.2.0.0.0. This issue affects some unknown functionality of the component Core. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Core). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

It is possible to read the advisory at oracle.com. The identification of this vulnerability is CVE-2026-101793 since 09/28/2026. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Oracle

Name

• Communications BRM

Version

• 15.0.0.0.0
• 15.0.1.0.0
• 15.1.0.0.0
• 15.2.0.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion