Oracle has disclosed a critical vulnerability (CVSS 9.8) in the Cloud native deployment component of Oracle Communications BRM - Elastic Charging Engine that lets an unauthenticated attacker with network access over RMI take over the product.
What Is It
CVE-2026-101763 is a vulnerability in the Cloud native deployment component of Oracle Communications BRM - Elastic Charging Engine. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access via RMI can use it to compromise the product, and a successful attack can result in takeover of Oracle Communications BRM - Elastic Charging Engine.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact: High confidentiality, integrity, and availability
NVD published the record on 2026-10-20 with a status of "Received," so NVD has not yet done its own analysis.
Why It Matters
The flaw combines network reachability, low complexity, no authentication, and no user interaction. Together these earn it a base score of 9.8 (CRITICAL), with an exploitability subscore of 3.9 and an impact subscore of 5.9. Full takeover affects confidentiality, integrity, and availability alike.
The supplied CISA KEV data contains no entry for this CVE, so KEV does not currently confirm active exploitation. Defenders should still treat any Elastic Charging Engine deployment with RMI reachable from the network as a high-priority exposure.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Communications BRM - Elastic Charging Engine
- Component: Cloud native deployment
- Affected supported versions:
- 15.0.0.0.0
- 15.0.1.0.0
- 15.1.0.0.0
- 15.2.0.0.0
The supplied NVD record lists no CPE entries.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory. Administrators running the affected versions should check that advisory for the fix and remediation guidance for their deployment, and apply it.
There is no CISA KEV entry, so no federal required action or due date applies at this time. Until patches are applied, limit network access to RMI on affected Elastic Charging Engine instances.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101763
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)