This vulnerability in Oracle Communications Billing and Revenue Management (BRM) affects versions 15.0.0.0.0 through 15.2.0.0.0. It allows an attacker with low privileges and logon access to the infrastructure where BRM executes to compromise the system, potentially leading to a full takeover. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality, integrity, and availability at a high level (score 7.8). The vulnerability is categorized under CWE-269 (Improper Privilege Management). Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory but has not provided explicit patch or mitigation details specific to this vulnerability in the advisory content.

Successful exploitation can lead to complete compromise of Oracle Communications Billing and Revenue Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the BRM environment, potentially disrupting billing operations and exposing sensitive data.

Oracle has published this vulnerability as part of its July 2026 Critical Patch Update advisory. However, no explicit patch or remediation details for CVE-2026-61091 are provided in the advisory content. Customers should consult the Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.