CISA Adds Oracle E-Business Suite and KNX Flaws to KEV Catalog

TL;DR

The CISA KEV catalog gained two entries on July 15, 2026. The agency confirmed active exploitation of CVE-2026-46817 in Oracle E-Business Suite and CVE-2023-4346 in KNX building automation devices. Federal agencies must remediate both under Binding Operational Directive 22-01.

Why It Matters

A KEV listing means attackers are abusing these flaws right now, not in theory. The Oracle bug scores 9.8 (Critical) and sits in Oracle Payments, which handles corporate payment flows. According to Shadowserver estimates cited in press reports, roughly 950 Oracle EBS instances remain exposed online. Meanwhile, the KNX flaw can lock owners out of building automation hardware.

How the Attacks Work

CVE-2026-46817: Oracle Payments Takeover

Unauthenticated attackers send crafted HTTP requests to the File Transmission component of Oracle Payments. Successful attacks lead to a takeover of the module, per the CISA alert. Threat intelligence firm Defused first observed in-the-wild exploitation against its honeypots on June 27, 2026, before any public proof-of-concept existed.

CVE-2023-4346: KNX Device Lockout

KNX devices that support Connection Authorization Option 1 rely on a BCU key password that often cannot be reset. An attacker with network or physical access can purge unprotected devices and set their own BCU key. As a result, owners lose access to their own hardware.

Affected Versions

The Oracle flaw affects Oracle E-Business Suite versions 12.2.3 through 12.2.15. The KNX issue affects devices that use KNX Connection Authorization and support Option 1, depending on the implementation.

Patch and Mitigation

Oracle fixed CVE-2026-46817 in its May 2026 Critical Security Patch Update, so apply it now and keep EBS interfaces off the public internet. For KNX gear, follow vendor guidance and isolate installations from untrusted networks. Additionally, the CISA KEV catalog deadline obliges federal agencies to remediate on schedule.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.