CVE-2026-101763
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated RMI Remote Code Execution in Oracle Communications BRM

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Oracle

Description
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-101763
EUVD
EUVD-2026-106164

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in Oracle Communications BRM - Elastic Charging Engine affecting versions 15.0.0.0.0 through 15.2.0.0.0. It allows unauthenticated attackers to remotely exploit the system via RMI, potentially leading to full system takeover. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability can be detected by checking for exposed RMI services on systems running Oracle Communications BRM - Elastic Charging Engine versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, or 15.2.0.0.0. Use network scanning tools like nmap to identify open RMI ports (default port 1099) and verify if the service is Oracle BRM related.

Impact Analysis

If you use Oracle Communications BRM - Elastic Charging Engine in your environment, an attacker could exploit this flaw to gain complete control over the system. This could lead to data breaches, service disruption, or unauthorized access to sensitive information processed by the charging engine.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal and health data. A successful exploit may result in data breaches, leading to regulatory fines, legal liabilities, and reputational damage for organizations handling sensitive information.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Communications BRM - Elastic Charging Engine versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. Restrict network access to the RMI port used by the service to prevent unauthenticated attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...