This vulnerability exists in the Diameter Gateway and SDK component of Oracle Communications BRM - Elastic Charging Engine. It affects versions 15.0.0.0.0 through 15.2.0.0.0. A low privileged attacker with access to the infrastructure where the product runs can exploit this flaw to compromise the system, potentially leading to complete takeover of the Elastic Charging Engine. The CVSS 3.1 vector indicates local attack vector with low attack complexity and low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the patch status or provide a direct patch link for this specific issue. Customers are urged to apply available patches from the advisory promptly to mitigate risk.

Successful exploitation can lead to complete compromise of Oracle Communications BRM - Elastic Charging Engine, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially disrupting charging operations and exposing sensitive data.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Customers should review the advisory and apply the relevant patches without delay. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, users must consult the official Oracle advisory for the latest remediation guidance. No alternative mitigations or workarounds are provided in the advisory.