{"id":"CVE-2026-101763","published":"2026-10-20T22:18:31Z","modified":"2026-10-21T18:44:55Z","title":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component…","vendor":"Oracle Corporation","product":"Oracle Communications BRM - Elastic Charging Engine","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Cloud native deployment component of Oracle Communications BRM - Elastic Charging Engine, affecting the 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 releases, lets the product's RMI interface be reached without authentication. An unauthenticated attacker with network access via RMI can take over the product, with full compromise of confidentiality, integrity and availability and no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:56Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00501,"percentile":0.4291,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-106164","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106164","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101763","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.58,"detail":"percentile 0.4291"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}