Vulnerability in Oracle Communications BRM - Elastic Charging Engine cloud native deployment component that allows remote exploitation via RMI protocol. Affects versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0.
An unauthenticated attacker with network access via RMI can achieve complete takeover of the Oracle Communications BRM - Elastic Charging Engine, including executing arbitrary code, modifying system data, and disrupting service availability.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes. Patch is available from Oracle.
Apply the security patch from Oracle immediately. Restrict network access to RMI ports used by Oracle Communications BRM - Elastic Charging Engine to trusted systems only. Implement network segmentation to limit exposure of the affected component.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-101763 . See article
NVD published the first details for CVE-2026-101763
A CVSS base score of 9.8 has been assigned.
Links to Mitre Att&cks
Oracle Critical Patch Update Advisory - October 2026
Vulnerability Watch, October 21, 2026: 108 critical CVEs and 31 new vendor and CERT advisories
15 changes (2 new | 13 updated):
Oracle Communications: CVSS (Max): 9.8
Oracle Critical Patch Update Advisory - October 2026
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
