# CVE-2026-101792: Oracle Communications BRM Elastic Charging Engine unauthorized data access via physical network access

Source: https://junglewise.ai/threats/cve-2026-101792-vulnerability-in-the-oracle-communications-brm-elastic-charging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-101792 · Severity: medium · CVSS 5.9 · Published 2026-10-20

The Oracle Communications BRM Elastic Charging Engine is a billing and charging platform used by telecommunications service providers. An attacker with direct physical access to the network segment connecting to the hardware can bypass security controls, potentially reading sensitive billing data and modifying or deleting critical charging records without authentication. This vulnerability could lead to service disruptions, revenue loss, or exposure of customer billing information.

Technologies: [Oracle Communications BRM - Elastic Charging Engine](https://junglewise.ai/threats/technologies/communications-brm-elastic-charging-engine). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-101792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101792 being exploited in the wild.

**How severe is CVE-2026-101792?** Medium severity, with a CVSS score of 5.9, published 20 October 2026.

**Which products and versions are affected?** Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0.

**Is there a fix for CVE-2026-101792?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101792 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-101792?** Check whether you run Oracle Communications BRM - Elastic Charging Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a difficult-to-exploit vulnerability in the security component that allows an unauthenticated attacker with physical access to the communication segment to compromise the system. The attack requires local/adjacent network access with high exploitation complexity but no user interaction. Successful exploitation results in unauthorized read access to data and high-impact modification or deletion of critical data on the affected system.

## Affected products

- Oracle Communications BRM Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle Communications BRM Elastic Charging Engine unauthorized data access](https://junglewise.ai/threats/cve-2026-101793-vulnerability-in-the-oracle-communications-brm-elastic-charging)
- [Oracle Communications BRM Elastic Charging Engine TLS authentication bypass](https://junglewise.ai/threats/cve-2026-101791-vulnerability-in-the-oracle-communications-brm-elastic-charging)
- [Oracle Communications BRM Elastic Charging Engine RMI remote code execution](https://junglewise.ai/threats/cve-2026-101763-vulnerability-in-the-oracle-communications-brm-elastic-charging)
- [Oracle Communications BRM Elastic Charging Engine takeover in Diameter Gateway](https://junglewise.ai/threats/cve-2026-61053-oracle-communications-brm-elastic-charging-engine-takeover-in)