---
id: "CVE-2026-101758"
kind: "vulnerability"
aliases: ["CVE-2026-101758"]
title: "Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes billing data"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["billing", "brm-server", "oracle", "telecom", "vendor"]
not_affected_if: ["http-not-exposed", "unsupported-version"]
published_at: "2026-10-20T22:18:31+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:04:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101758", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes billing data

Oracle Communications Billing and Revenue Management (BRM Server) versions 15.0.0.0.0 through 15.2.0.0.0 contain a flaw that lets an unauthenticated attacker reach the product over HTTP. A successful attack gives read access to critical data and limited ability to update, insert or delete data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether BRM Server is deployed and note its version, for example with `pin_cfg` or the installed package listing, since the sources do not name a check command
- Check whether the BRM HTTP interface is reachable from untrusted networks
- unknown for a vendor-specific version command

## Fix

- Apply the Oracle Critical Patch Update for Oracle Communications Billing and Revenue Management that covers BRM Server 15.x
- Restrict network access to the BRM HTTP interface until patched
- unknown for the exact patched build number

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101758

## From the sources

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_