CISA added CVE-2026-46817 in Oracle E-Business Suite and CVE-2023-4346 in the KNX building-automation protocol to its Known Exploited Vulnerabilities Catalog on July 15, confirming that attackers are using both flaws in real-world incidents. The Oracle vulnerability demands the fastest response: it carries a CVSS 3.1 score of 9.8 and can let an unauthenticated attacker take over vulnerable Oracle Payments deployments through HTTP.
The additions were detailed in a CISA alert accompanying the catalog update. Although CISA’s remediation requirements directly bind Federal Civilian Executive Branch agencies, inclusion in the KEV Catalog is a practical patch-now signal for private-sector administrators as well.
For Windows-focused IT teams, neither entry should be dismissed simply because it is not a Windows CVE. Oracle E-Business Suite commonly connects to identity, finance, file-transfer, database, monitoring, and endpoint-management infrastructure, while KNX installations can sit behind Windows workstations running engineering and building-management tools.
CVE-2026-46817 affects the File Transmission component of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Oracle describes it as an easily exploitable vulnerability reachable over HTTP without credentials or user interaction.
A successful attack can result in a takeover of Oracle Payments, with high potential impact to confidentiality, integrity, and availability. The flaw is associated with improper privilege management, improper authentication, and missing authentication for a critical function.
Oracle disclosed and patched CVE-2026-46817 in its May 28, 2026 Critical Security Patch Update. That advisory included 12 new fixes for Oracle E-Business Suite, three of which Oracle classified as remotely exploitable without authentication.
Reports of exploitation emerged about a month later. Threat-intelligence company Defused said its Oracle E-Business Suite honeypots recorded exploitation on June 27, before a public proof-of-concept was known to be available. NHS England’s National Cyber Security Operations Centre subsequently warned on June 29 that further exploitation was highly likely.
CISA’s addition removes any remaining ambiguity about whether administrators should treat those observations as isolated scanning. The vulnerability now meets the agency’s criteria of having a CVE identifier, reliable evidence of active exploitation, and actionable mitigation guidance.
Organizations running affected versions should apply Oracle’s May 2026 security update or a later applicable update immediately. Oracle directs E-Business Suite Release 12 customers to the corresponding patch documentation in My Oracle Support, and also recommends updating the Oracle Database and Oracle Fusion Middleware components used by E-Business Suite where applicable.
Older installations create a separate problem. NHS England advises organizations running sustaining-support or end-of-life releases to move to a supported version, since simply searching for a patch against an obsolete deployment may not produce a complete remediation path.
KNX is used to connect and manage systems such as lighting, heating, ventilation, air conditioning, shutters, access controls, and other building functions. The weakness involves the protocol’s BCU key mechanism, which can be used to set a device password that may not be reset without knowing the existing password.
According to the original CISA industrial-control advisory and the National Vulnerability Database, an attacker with access to the relevant network can interact with a KNX installation, purge devices that lack additional security protections, and assign a BCU key. Physical access can provide another exploitation route even when a device is not network-connected.
The result is primarily an availability failure rather than data theft. Legitimate users can be denied the ability to administer or recover devices, potentially disrupting the physical processes those devices control. The vulnerability has a CVSS 3.1 score of 7.5, reflecting a high-severity availability impact with no direct confidentiality or integrity impact in the published vector.
That distinction should not reduce its operational priority. Locking operators out of lighting, environmental controls, or other building systems can create costly and potentially safety-relevant outages, particularly in hospitals, campuses, industrial sites, data centers, and large commercial facilities.
CISA’s mitigation guidance for the original KNX advisory emphasized reducing network exposure, placing control-system networks and remote devices behind firewalls, and isolating them from business networks. Remote access should use secure methods such as an updated virtual private network, with administrators recognizing that a VPN is only as secure as its configuration and connected endpoints.
Organizations should also identify installations still relying on Connection Authorization Option 1 and consult their device manufacturers or KNX integrators about supported security controls. KNX Secure protections and properly segmented architectures are particularly important because the catalog entry names a protocol option, not a single easily inventoried Windows application or appliance model.
That risk-based approach is reinforced by Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. The directive requires federal civilian agencies to concentrate rapid remediation on KEV vulnerabilities affecting publicly exposed assets when exploitation could provide total control, while allowing lower-risk issues to be handled with less urgency.
BOD 26-04 also goes beyond patch installation by setting expectations for compromise assessment. Under specified circumstances, agencies must determine whether an attacker entered the system before the update was applied. That is especially relevant to CVE-2026-46817 because exploitation was observed weeks after Oracle shipped its fix, leaving a meaningful exposure window for organizations that delayed deployment.
Private organizations are not legally bound by the directive, but CISA recommends that they use the same model. In practice, that means the Oracle response should include both remediation and threat hunting rather than ending when the patch job reports success.
Administrators should preserve and review Oracle E-Business Suite web, application, authentication, file-transfer, and reverse-proxy logs covering at least the period since Oracle’s May 28 disclosure. Unexpected HTTP requests to Oracle Payments interfaces, new or altered accounts, unauthorized financial configuration changes, unusual outbound connections, and unexplained file activity warrant investigation.
For KNX, the evidence may exist in less familiar places. Facilities teams, building integrators, network administrators, and security operations staff may need to combine controller logs, firewall records, engineering workstation activity, configuration backups, and physical-access records to determine whether a lockout was malicious.
Security teams should therefore verify ownership before assuming another department has handled the alert. Asset inventories need to identify affected Oracle E-Business Suite versions, externally reachable Oracle Payments interfaces, KNX network boundaries, relevant engineering workstations, and the parties authorized to change each environment.
Patching CVE-2026-46817 is the immediate priority, followed by a compromise review covering the pre-patch exposure period. CVE-2023-4346 requires a more environment-specific response, but CISA’s July 15 catalog update makes one point clear: legacy KNX authorization mechanisms are no longer merely a design concern—they are being exploited.
The additions were detailed in a CISA alert accompanying the catalog update. Although CISA’s remediation requirements directly bind Federal Civilian Executive Branch agencies, inclusion in the KEV Catalog is a practical patch-now signal for private-sector administrators as well.
For Windows-focused IT teams, neither entry should be dismissed simply because it is not a Windows CVE. Oracle E-Business Suite commonly connects to identity, finance, file-transfer, database, monitoring, and endpoint-management infrastructure, while KNX installations can sit behind Windows workstations running engineering and building-management tools.
Oracle Payments Faces an Unauthenticated Takeover Path
CVE-2026-46817 affects the File Transmission component of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Oracle describes it as an easily exploitable vulnerability reachable over HTTP without credentials or user interaction.A successful attack can result in a takeover of Oracle Payments, with high potential impact to confidentiality, integrity, and availability. The flaw is associated with improper privilege management, improper authentication, and missing authentication for a critical function.
Oracle disclosed and patched CVE-2026-46817 in its May 28, 2026 Critical Security Patch Update. That advisory included 12 new fixes for Oracle E-Business Suite, three of which Oracle classified as remotely exploitable without authentication.
Reports of exploitation emerged about a month later. Threat-intelligence company Defused said its Oracle E-Business Suite honeypots recorded exploitation on June 27, before a public proof-of-concept was known to be available. NHS England’s National Cyber Security Operations Centre subsequently warned on June 29 that further exploitation was highly likely.
CISA’s addition removes any remaining ambiguity about whether administrators should treat those observations as isolated scanning. The vulnerability now meets the agency’s criteria of having a CVE identifier, reliable evidence of active exploitation, and actionable mitigation guidance.
Organizations running affected versions should apply Oracle’s May 2026 security update or a later applicable update immediately. Oracle directs E-Business Suite Release 12 customers to the corresponding patch documentation in My Oracle Support, and also recommends updating the Oracle Database and Oracle Fusion Middleware components used by E-Business Suite where applicable.
Older installations create a separate problem. NHS England advises organizations running sustaining-support or end-of-life releases to move to a supported version, since simply searching for a patch against an obsolete deployment may not produce a complete remediation path.
A 2023 KNX Weakness Returns as an Active Threat
CVE-2023-4346 is older and technically different, but its appearance in KEV makes it newly urgent. The vulnerability affects KNX devices using KNX Connection Authorization Option 1 and can allow an attacker to lock legitimate operators out of building-automation equipment.KNX is used to connect and manage systems such as lighting, heating, ventilation, air conditioning, shutters, access controls, and other building functions. The weakness involves the protocol’s BCU key mechanism, which can be used to set a device password that may not be reset without knowing the existing password.
According to the original CISA industrial-control advisory and the National Vulnerability Database, an attacker with access to the relevant network can interact with a KNX installation, purge devices that lack additional security protections, and assign a BCU key. Physical access can provide another exploitation route even when a device is not network-connected.
The result is primarily an availability failure rather than data theft. Legitimate users can be denied the ability to administer or recover devices, potentially disrupting the physical processes those devices control. The vulnerability has a CVSS 3.1 score of 7.5, reflecting a high-severity availability impact with no direct confidentiality or integrity impact in the published vector.
That distinction should not reduce its operational priority. Locking operators out of lighting, environmental controls, or other building systems can create costly and potentially safety-relevant outages, particularly in hospitals, campuses, industrial sites, data centers, and large commercial facilities.
CISA’s mitigation guidance for the original KNX advisory emphasized reducing network exposure, placing control-system networks and remote devices behind firewalls, and isolating them from business networks. Remote access should use secure methods such as an updated virtual private network, with administrators recognizing that a VPN is only as secure as its configuration and connected endpoints.
Organizations should also identify installations still relying on Connection Authorization Option 1 and consult their device manufacturers or KNX integrators about supported security controls. KNX Secure protections and properly segmented architectures are particularly important because the catalog entry names a protocol option, not a single easily inventoried Windows application or appliance model.
KEV Changes the Order of Work
The KEV Catalog is not a list of every severe vulnerability, nor is it sorted solely by CVSS score. Its defining feature is evidence that exploitation has occurred, which gives administrators a stronger basis for moving an issue ahead of vulnerabilities that are theoretically worse but not known to be under attack.That risk-based approach is reinforced by Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. The directive requires federal civilian agencies to concentrate rapid remediation on KEV vulnerabilities affecting publicly exposed assets when exploitation could provide total control, while allowing lower-risk issues to be handled with less urgency.
BOD 26-04 also goes beyond patch installation by setting expectations for compromise assessment. Under specified circumstances, agencies must determine whether an attacker entered the system before the update was applied. That is especially relevant to CVE-2026-46817 because exploitation was observed weeks after Oracle shipped its fix, leaving a meaningful exposure window for organizations that delayed deployment.
Private organizations are not legally bound by the directive, but CISA recommends that they use the same model. In practice, that means the Oracle response should include both remediation and threat hunting rather than ending when the patch job reports success.
Administrators should preserve and review Oracle E-Business Suite web, application, authentication, file-transfer, and reverse-proxy logs covering at least the period since Oracle’s May 28 disclosure. Unexpected HTTP requests to Oracle Payments interfaces, new or altered accounts, unauthorized financial configuration changes, unusual outbound connections, and unexplained file activity warrant investigation.
For KNX, the evidence may exist in less familiar places. Facilities teams, building integrators, network administrators, and security operations staff may need to combine controller logs, firewall records, engineering workstation activity, configuration backups, and physical-access records to determine whether a lockout was malicious.
Asset Ownership Is the Immediate Test
The two additions expose a recurring weakness in enterprise vulnerability programs: products outside the conventional Windows endpoint fleet often have unclear owners. Oracle E-Business Suite may be administered by a business-applications group, while KNX equipment may belong to facilities or an external integrator, yet both can depend on Active Directory identities, Windows management stations, shared network services, and centralized backups.Security teams should therefore verify ownership before assuming another department has handled the alert. Asset inventories need to identify affected Oracle E-Business Suite versions, externally reachable Oracle Payments interfaces, KNX network boundaries, relevant engineering workstations, and the parties authorized to change each environment.
Patching CVE-2026-46817 is the immediate priority, followed by a compromise review covering the pre-patch exposure period. CVE-2023-4346 requires a more environment-specific response, but CISA’s July 15 catalog update makes one point clear: legacy KNX authorization mechanisms are no longer merely a design concern—they are being exploited.
References
- Primary source: CISA
Published: 2026-07-15T12:00:00+00:00
