CVE-2026-61091

{
  "id": "CVE-2026-61091",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:18:40.110",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Communications Billing and Revenue Management de Oracle Communications (componente: BRM servidor). Las versiones compatibles que están afectadas son 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 y 15.2.0.0.0. La vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y con inicio de sesión en la infraestructura donde se ejecuta Oracle Communications Billing and Revenue Management comprometer Oracle Communications Billing and Revenue Management. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Communications Billing and Revenue Management. Puntuación Base CVSS 3.1 de 7.8 (Impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Communications Billing and Revenue Management",
          "versions": [
            {
              "version": "15.0.0.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.0.1.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.1.0.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.2.0.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T13:58:14.574997Z",
          "id": "CVE-2026-61091",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2891E797-A17D-4A2F-8725-B7B737FC596B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA55A34-4139-4210-A638-D6CA3710B7FE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.1.0.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D7D9CB5-27EE-4C20-A127-B7A42D8CDB3F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.2.0.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDDF08CB-0085-4320-9B59-57A432B18D1A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}