{"id":"CVE-2026-101763","kind":"vulnerability","aliases":["CVE-2026-101763"],"related":[],"title":"Oracle BRM Elastic Charging Engine: unauthenticated RMI flaw allows full takeover","description":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Communications BRM Elastic Charging Engine versions 15.0.0.0.0 through 15.2.0.0.0 have a flaw in the cloud native deployment component reachable over RMI. An unauthenticated attacker with network access can take over the product, with high impact to confidentiality, integrity and availability.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Communications BRM - Elastic Charging Engine","fixed":[],"affected":"15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["billing","brm","cloud-native","oracle","other","rmi","self-hosted","telecom","vendor"],"not_affected_if":["not-cloud-native-deployment","rmi-not-network-reachable","versions-outside-15.0.0.0.0-to-15.2.0.0.0"],"how_to_check":"Check installed BRM / Elastic Charging Engine release: affected if 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 or 15.2.0.0.0 with the cloud native deployment. Check whether the ECE RMI ports are reachable from untrusted networks (exact port not stated in public sources).","fix":"Apply the October 2026 CPU patch for Oracle Communications BRM - Elastic Charging Engine via the My Oracle Support patch availability document; patched release number unknown from public sources. Until then restrict network access to the RMI endpoints.","status":"open","published_at":"2026-10-20T22:18:31+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:40+00:00","updated_at":"2026-10-23T23:07:08+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:38:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle BRM Elastic Charging Engine: unauthenticated RMI flaw allows full takeover","impact":"high","summary":"Oracle Communications BRM Elastic Charging Engine versions 15.0.0.0.0 through 15.2.0.0.0 have a flaw in the cloud native deployment component reachable over RMI. An unauthenticated attacker with network access can take over the product, with high impact to confidentiality, integrity and availability.","category":"vendor","who_cares":["oracle","telecom","billing","cloud-native"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the charging engine remotely without credentials","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched 15.x release and the RMI port guidance at https://nvd.nist.gov/vuln/detail/CVE-2026-101763","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-15.0.0.0.0-to-15.2.0.0.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000522,"input_tokens":3126,"output_tokens":418,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched 15.x release and the RMI port guidance at https://nvd.nist.gov/vuln/detail/CVE-2026-101763","search":"'-101763':14A,17A '-2026':13A,16A '/av':155C '15.0.0.0.0':44B,101C '15.0.1.0.0':102C '15.1.0.0.0':103C '15.2.0.0.0':46B,105C '3.1':142C,154C '9.8':145C 'access':64B,114C 'affect':99C 'allow':9A,109C 'attack':61B,111C,126C 'avail':77B,149C 'base':143C 'bill':24B 'brm':2A,20A,25B,39B,83C,121C,137C 'charg':4A,41B,85C,123C,139C 'charging':22A 'cloud':27B,52B,92C 'cloud-nat':26B 'communic':38B,82C,90C,120C,136C 'communications':19A 'compon':55B,91C 'compromis':118C 'confidenti':74B,146C 'cve':12A,15A 'cvss':141C,151C,153C 'deploy':54B,94C 'easili':106C 'elast':3A,40B,84C,122C,138C 'elastic':21A 'engin':5A,42B,86C,124C,140C 'engine':23A 'exploit':107C 'flaw':8A,49B 'full':10A 'h':163C 'h/a':162C 'h/i':161C 'high':71B 'host':34B 'impact':72B,150C 'integr':75B,147C 'l/pr':157C 'n/ac':156C 'n/s':159C 'n/ui':158C 'nativ':28B,53B,93C 'network':63B,113C 'oracl':1A,29B,37B,81C,89C,119C,135C 'oracle':18A 'product':69B,87C 'reachabl':56B 'result':131C 'rmi':7A,31B,58B,116C 'score':144C 'self':33B 'self-host':32B 'success':125C 'support':95C 'take':66B 'takeov':11A,133C 'telecom':35B 'u/c':160C 'unauthent':6A,60B,110C 'vector':152C 'vendor':36B 'version':43B,96C 'via':115C 'vulner':78C,108C,129C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101763","severity":null,"published_at":"2026-10-20T22:18:31+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101763:371","url":null,"severity":null,"published_at":"2026-10-23T23:07:08+00:00","modified_at":"2026-10-23T23:07:08+00:00","first_seen_at":"2026-10-23T23:07:08+00:00","fetched_at":"2026-10-23T23:07:08+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists BRM Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0 as affected; CVSS 9.8 per CVE record. Exact fixed version and RMI port guidance are in MOS patch availability doc (support login), not public; not read. No exploitation or PoC found (OpenCVE: KEV no, EPSS <1%). Did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1788,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101763","title":"CVE Record: CVE-2026-101763","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}