CISA adds Oracle EBS and KNX vulnerabilities to KEV catalog
CISA has added CVE-2023-4346 (KNX Protocol authorization flaw) and CVE-2026-46817 (Oracle E-Business Suite privilege escalation) to its Known Exploited Vulnerabilities catalog based on active exploitation evidence.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-4346 and CVE-2026-46817 as exploited in the wild.
CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with two actively-exploited vulnerabilities that require immediate remediation attention. CVE-2023-4346 affects the KNX Protocol implementation and involves an overly restrictive account lockout mechanism that allows bypass of connection authorization controls. CVE-2026-46817 is an improper privilege management flaw in Oracle E-Business Suite that can lead to unauthorized privilege escalation.
These additions underscore CISA's commitment to maintaining the KEV Catalog as a prioritized remediation resource for the federal enterprise and beyond. Organizations should treat these vulnerabilities as high-priority, particularly on externally exposed systems, given the confirmed active exploitation. CISA's Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize patching of KEV Catalog entries, and CISA encourages all organizations—regardless of sector—to adopt similar risk-based vulnerability management practices and check for potential prior compromise before applying patches.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs