Oracle BRM Elastic Charging Engine Cloud RMI Vuln Enables Unauthenticated Full System Control

Oracle Communications BRM Elastic Charging Engine contains a severe vulnerability allowing system takeover. Security teams must verify if their cloud-native deployments run affected versions, as the flaw permits unauthenticated remote compromise.

What happened

A critical vulnerability, tracked as CVE-2026-101763, exists within the Oracle Communications BRM Elastic Charging Engine product. The flaw specifically impacts cloud-native deployments of the software. According to the National Vulnerability Database, the issue allows an unauthenticated attacker with network access to exploit the system via Remote Method Invocation (RMI). Successful exploitation results in takeover of the affected Oracle Communications BRM Elastic Charging Engine instance.

Why it matters

The affected software versions are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. The National Vulnerability Database assigns the flaw a CVSS 3.1 Base Score of 9.8, classifying it as critical. The vector indicates that the attack is easily exploitable over the network without any user interaction or authentication. Confidentiality, integrity, and availability are all impacted by a successful compromise.

Next steps

• Identify all instances of BRM Elastic Charging Engine in your environment.
• Check version numbers against the affected list: 15.0.0.0.0 to 15.2.0.0.0.
• Restrict network access to RMI ports for non-essential systems.
• Monitor for unauthorised process execution on affected hosts.

Detection notes

Security operations teams should monitor for anomalous RMI traffic originating from untrusted sources. Look for unexpected process creation or privilege escalation events on hosts running the affected software. Check application logs for unauthenticated connection attempts that succeed. Verify that no new administrative accounts have been created. Isolate compromised systems immediately to prevent lateral movement. Analyse network flows for beaconing behaviour or data exfiltration patterns consistent with remote control.

What to do and how to stay safe: Oracle Communications

• Conduct an immediate inventory of all BRM Elastic Charging Engine installations.
• Segment networks to restrict RMI access to trusted management interfaces only.
• Enable enhanced logging on RMI endpoints to capture connection metadata.
• Review firewall rules to block unauthorised inbound connections to affected ports.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle BRM versions are affected by CVE-2026-101763?

Versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 are affected.

Is the vulnerability exploitable without authentication?

Yes, the flaw allows unauthenticated attackers with network access to exploit it.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score is 9.8, rated as critical.