This vulnerability exists in the Diameter Gateway and SDK component of Oracle Communications BRM - Elastic Charging Engine. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to complete compromise of the Elastic Charging Engine, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for it. Customers are strongly advised to apply Oracle Critical Patch Updates promptly as per Oracle's general guidance.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to fully compromise the Oracle Communications BRM - Elastic Charging Engine. This results in high impact on confidentiality, integrity, and availability of the affected system, potentially allowing takeover of the product and unauthorized control over its functions.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for this vulnerability. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant patches promptly. Maintaining up-to-date patching is critical as Oracle reports ongoing exploitation attempts against vulnerabilities for which patches exist. No vendor advisory states that no action is required or that the vulnerability is already mitigated.