This vulnerability affects the BRM Server component of Oracle Communications Billing and Revenue Management in versions 15.0.0.0.0 through 15.2.0.0.0. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the product. Successful exploitation can lead to full compromise and takeover of the Oracle Communications Billing and Revenue Management system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous security patches across Oracle products, but does not explicitly state a patch or fix for this vulnerability. Customers are urged to apply available patches promptly as per Oracle's general guidance.

The vulnerability allows a low privileged attacker with logon access to the infrastructure to compromise Oracle Communications Billing and Revenue Management, leading to full system takeover. This results in high impact on confidentiality, integrity, and availability of the affected system.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch or fix for CVE-2026-61091. Customers should review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly to mitigate this and other vulnerabilities. Until explicit patch information is confirmed, patch status remains unconfirmed. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.