CVE-2026-61053

Undergoing Analysis Undergoing Analysis - In Progress

Oracle Communications BRM ECE Privilege Escalation

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Diameter Gateway and SDK). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61053

EUVD

EUVD-2026-47267

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	communications_brm_elastic_charging_engine	15.0.0.0.0
oracle	communications_brm_elastic_charging_engine	15.0.1.0.0
oracle	communications_brm_elastic_charging_engine	15.1.0.0.0
oracle	communications_brm_elastic_charging_engine	15.2.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Communications BRM - Elastic Charging Engine affecting versions 15.0.0.0.0 through 15.2.0.0.0. It allows a low-privileged attacker with local access to compromise the system and potentially take it over. The vulnerability has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for vulnerable versions of Oracle Communications BRM - Elastic Charging Engine (15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0). Inspect installed software versions and logs for Diameter Gateway or SDK components. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full control over the Oracle Communications BRM - Elastic Charging Engine. This could lead to unauthorized access, data breaches, service disruption, or complete system takeover, depending on the system's role in your infrastructure.

Compliance Impact

The vulnerability allows low-privileged attackers to compromise the Oracle Communications BRM - Elastic Charging Engine, potentially leading to unauthorized access, data breaches, or service disruption. This could impact compliance with GDPR by risking unauthorized access to personal data and HIPAA by compromising protected health information integrity and availability.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Communications BRM - Elastic Charging Engine versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. Restrict user access to the infrastructure where the component executes to minimize attack surface.

Hi! I’m here to help you understand CVE-2026-61053. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70