Oracle Communications Billing And Revenue Management Elastic Charging Engine vulnerabilities

31 CVEs affecting Oracle Communications Billing And Revenue Management Elastic Charging Engine, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61053, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2019-10173, published 2019-07-23. Critical severity, CVSS 9.8. EPSS: 95% chance of exploitation in the next 30 days. It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2021-21351, published 2021-03-23. Critical severity, CVSS 9.1. EPSS: 82.1% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a…
CVE-2021-21341, published 2021-03-23. High severity, CVSS 7.5. EPSS: 77.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21344, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-21345, published 2021-03-23. Critical severity, CVSS 9.9. EPSS: 72.3% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute…
CVE-2021-21349, published 2021-03-23. High severity, CVSS 8.6. EPSS: 46.8% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal…
CVE-2021-21343, published 2021-03-23. High severity, CVSS 7.5. EPSS: 46.7% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type…

Latest

CVE-2026-61053, published 2026-07-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Diameter Gateway and SDK). Supported versions that are affected are 15.0.0.0.0,…
CVE-2023-21824, published 2023-01-18. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager). Supported versions that are…
CVE-2021-39152, published 2021-08-23. High severity, CVSS 8.5. EPSS: 11.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39150, published 2021-08-23. High severity, CVSS 8.5. EPSS: 3.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39140, published 2021-08-23. Medium severity, CVSS 6.3. EPSS: 5.9% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on…
CVE-2021-39154, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39153, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.5% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39151, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39149, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39148, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…