---
id: "CVE-2026-101759"
kind: "vulnerability"
aliases: ["CVE-2026-101759"]
title: "Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes critical data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["billing", "brm-server", "oracle", "telecom", "vendor"]
not_affected_if: ["no-network-http-exposure", "unaffected-version"]
published_at: "2026-10-20T22:18:31+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:19:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101759", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes critical data

Oracle Communications Billing and Revenue Management (BRM Server) versions 15.0 through 15.2 contain a flaw that an unauthenticated attacker can reach over HTTP from the network. A successful attack gives read access to critical data stored in the BRM system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BRM Server version against 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0
- Confirm whether BRM HTTP endpoints are reachable from untrusted networks (unknown from sources)

## Fix

- Apply the Oracle Critical Patch Update that covers the BRM Server component (patch identifier unknown from sources)
- Restrict network access to BRM HTTP interfaces until patched

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101759

## From the sources

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_