Oracle BRM Critical Flaw Lets Attackers Alter Billing Data Without Login

Oracle Communications Billing and Revenue Management contains a critical vulnerability that allows anyone with network access to manipulate core billing data. According to the National Vulnerability Database, this flaw requires no authentication, meaning an attacker does not need stolen passwords or valid user accounts. The issue exposes the system to unauthorized creation, deletion, or modification of records, giving external actors direct control over sensitive financial information.

In plain English

This vulnerability allows a remote attacker to send HTTP requests to the Oracle BRM server and change data directly. The NVD record states that successful exploitation results in high impacts to confidentiality and integrity. An attacker can view private billing details, alter transaction records, or delete existing data entirely. Because the flaw is easily exploitable and requires no user interaction, it presents a direct risk to exposed servers.

The background

The affected software is Oracle Communications Billing and Revenue Management, a platform used for managing customer billing and revenue operations. The National Vulnerability Database identifies four specific versions as vulnerable: 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The CVSS vector indicates the attack vector is network-based with low complexity. No privilege escalation is needed because the initial access is unauthenticated. The impact does not include availability disruption, but the data integrity and confidentiality risks are severe.

What changes now

Organizations using these specific BRM versions must treat this as an urgent risk due to the lack of authentication requirements. The NVD classifies the vulnerability as critical with a base score of 9.1. Since the flaw allows complete access to all accessible data, the potential for data corruption is significant. Teams should verify their current version against the affected list immediately. No fix has been confirmed yet.

What made it possible

Security teams usually face challenges when network-facing services lack proper input validation or authentication checks. This incident highlights the risk of exposing administrative or data-manipulation interfaces directly to the internet without requiring credentials. Attackers exploit these gaps to bypass identity verification, allowing them to perform actions as if they were authorized users.

Check whether your exposed services require authentication for all data-modification endpoints. Ensure that network segmentation limits direct access to sensitive billing components from untrusted zones. Regularly review access logs for unusual HTTP traffic patterns that may indicate automated scanning or exploitation attempts.

What to do and how to stay safe: Oracle

• Verify which version of Oracle Communications Billing and Revenue Management is currently deployed in your environment.
• Restrict network access to the BRM server to trusted internal networks only, blocking direct HTTP traffic from the internet.
• Monitor server logs for unauthorized HTTP requests that attempt to create, modify, or delete data without prior authentication.
• Contact your vendor to inquire about the availability of a security update or patch for CVE-2026-101765.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle BRM versions are affected by CVE-2026-101765?

The National Vulnerability Database lists versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 as affected.

Does an attacker need a password to exploit this flaw?

No, the NVD record states the vulnerability allows an unauthenticated attacker to compromise the system.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score is 9.1, classified as Critical.