As reported by CISA in its July 15, 2026 advisory, two newly catalogued vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) list — confirming active, real-world exploitation activity that organizations can no longer treat as theoretical risk.
Vulnerability Snapshot
- CVE-2023-4346
- Vendor/Product: KNX Association — KNX Protocol (Connection Authorization Option 1)
- Type: Overly Restrictive Account Lockout Mechanism
- Environment: Building automation, industrial control systems, smart infrastructure
- Active Exploitation: Confirmed (KEV listing)
- Patch/Mitigation: Consult KNX Association security guidance; network segmentation strongly advised
- CVE-2026-46817
- Vendor/Product: Oracle E-Business Suite
- Type: Improper Privilege Management
- Environment: Enterprise ERP deployments, government and commercial sectors
- Active Exploitation: Confirmed (KEV listing)
- Patch/Mitigation: Apply Oracle Critical Patch Update; restrict unauthenticated access to EBS interfaces
Why This Combination Should Alarm Security Teams
At first glance, these two vulnerabilities appear unrelated — one sits in operational technology (OT) building infrastructure, the other in enterprise resource planning (ERP) software. That divergence is precisely what makes this KEV addition strategically significant. Threat actors are not narrowing their focus; they are broadening it.
CVE-2023-4346 targets the KNX protocol, the dominant open standard for building automation and control. HVAC, lighting, access control, and energy management systems worldwide rely on KNX. An account lockout mechanism vulnerability in KNX's Connection Authorization Option 1 may allow attackers to bypass or abuse authentication controls — potentially enabling persistent, unauthorized access to physical infrastructure. The fact that this CVE carries a 2023 identifier and is only now surfacing in active exploitation campaigns suggests threat actors have been quietly weaponizing it, possibly for reconnaissance or staging within smart building environments. Critical infrastructure operators and facilities management teams at hospitals, government buildings, airports, and data centers should treat this with the urgency typically reserved for SCADA vulnerabilities.
CVE-2026-46817 in Oracle E-Business Suite is a different class of threat entirely. Improper privilege management in EBS can allow lower-privileged users or external actors to escalate access within one of the most data-rich enterprise platforms in existence. Oracle EBS houses financials, HR records, supply chain data, procurement workflows, and sensitive regulatory information. A successful privilege escalation here doesn't just expose data — it can enable fraudulent transactions, exfiltrate intellectual property, or serve as a pivot point into broader enterprise networks. Given Oracle EBS's prevalence in government contractors and federal supply chains, this vulnerability likely has national security implications beyond the enterprise IT context.
The Broader Pattern: KEV as an Exploitation Intelligence Signal
CISA's KEV catalog has matured into one of the most operationally reliable threat intelligence feeds available to defenders. A KEV listing is not a prediction — it is a confirmation. By the time a vulnerability appears here, exploitation is already occurring. Organizations that treat KEV additions as a 30-day remediation timeline are already behind. The new BOD 26-04 directive tightens expectations for federal agencies, but commercial and critical infrastructure operators should adopt the same posture voluntarily.
Shield53 Perspective: The pairing of an OT protocol vulnerability with an enterprise ERP flaw in a single KEV update reflects the expanding attack surface modern organizations must defend. Silos between IT security and OT/facilities security teams are no longer operationally acceptable.
Who Is Most at Risk
Shield53 Recommendations: Immediate Actions
For CVE-2023-4346 (KNX Protocol)
- Immediately audit all KNX-connected devices and controllers for exposure to untrusted networks
- Implement strict network segmentation — KNX bus systems should never be reachable from corporate IT or internet-facing segments
- Review KNX Association's published security hardening guidance and apply any available firmware or configuration updates
- Enable logging and anomaly detection on KNX traffic; look for unusual connection attempts or authentication pattern deviations
- Engage your physical security and facilities teams immediately — this is not a purely IT issue
For CVE-2026-46817 (Oracle E-Business Suite)
- Apply the relevant Oracle Critical Patch Update without delay — do not wait for scheduled maintenance windows
- Conduct a privilege audit across all EBS user accounts; revoke unnecessary elevated permissions immediately
- Review Oracle EBS access logs for anomalous privilege use or lateral movement indicators dating back at least 90 days
- Restrict internet-facing Oracle EBS interfaces; enforce multi-factor authentication on all administrative accounts
- Assess whether compromise may have occurred prior to patching — CISA's BOD 26-04 explicitly requires this for federal agencies, and it is sound practice for all organizations
General Posture
- Subscribe to CISA KEV catalog updates as a primary threat intelligence feed and integrate them into your vulnerability management SLAs
- Do not rely solely on CVSS scores for prioritization — confirmed exploitation status, as indicated by KEV listing, must override theoretical severity ratings
