CVE-2026-101765 is a critical (CVSS 9.1), easily exploitable vulnerability in the BRM Server component of Oracle Communications Billing and Revenue Management that lets an unauthenticated attacker with network access over HTTP compromise the product.
What Is It
CVE-2026-101765 is a vulnerability in the BRM Server component of Oracle Communications Billing and Revenue Management. Oracle is the CNA ([email protected]). The record was published to NVD on 2026-10-20 and currently has a status of "Received."
Oracle describes it as "easily exploitable." An attacker needs no authentication and no user interaction. Network access via HTTP is enough to compromise the product.
Why It Matters
The CVSS 3.1 base score is 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Confidentiality / Integrity / Availability: High / High / None
Oracle says a successful attack can result in:
- Unauthorized creation, deletion, or modification of critical data, or of all data accessible to Oracle Communications Billing and Revenue Management
- Unauthorized access to critical data, or complete access to all data accessible to Oracle Communications Billing and Revenue Management
Billing and revenue platforms hold sensitive customer and financial records, so a full read/write compromise without credentials is high-impact. Availability is not affected.
Exploitation status: CVE-2026-101765 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
Product: Oracle Communications Billing and Revenue Management (component: BRM Server) Vendor: Oracle Corporation
Affected supported versions:
- 15.0.0.0.0
- 15.0.1.0.0
- 15.1.0.0.0
- 15.2.0.0.0
NVD has not yet listed any affected CPEs.
Patch Status
The NVD record cites Oracle's Critical Patch Update Advisory for October 2026. That advisory is Oracle's channel for fixes to this issue. Administrators running any affected BRM version should review it and apply the relevant patches.
There is no CISA KEV entry, so no federal remediation deadline or required action applies at this time. Because the flaw needs no authentication and can be reached over HTTP, organizations should prioritize patching any BRM Server instance that is reachable over the network.