Listen to this Post
Introduction, A New Warning for Organizations Before Attackers Strike Again
Cybersecurity threats continue to evolve at an alarming pace, and organizations around the world are facing increasing pressure to secure their infrastructure before attackers exploit known weaknesses. Every month, thousands of vulnerabilities are disclosed, but only a relatively small number become so dangerous that they are officially recognized as being actively exploited in real-world attacks.
That is exactly why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains its Known Exploited Vulnerabilities (KEV) Catalog. When a vulnerability appears on this list, it is no longer considered a theoretical risk. Instead, it has become an active security threat that organizations should prioritize immediately.
CISA has now expanded its KEV Catalog with two significant vulnerabilities affecting Oracle enterprise software and KNX building automation systems. Federal agencies have received strict deadlines to remediate these flaws, while security experts are urging private organizations to move just as quickly.
The warning highlights a growing trend across the cybersecurity industry. Attackers are increasingly abandoning expensive zero-day exploits and instead targeting already-known vulnerabilities that remain unpatched inside organizations.
CISA Adds Two High-Priority Vulnerabilities to KEV Catalog
The Cybersecurity and Infrastructure Security Agency officially added two newly recognized exploited vulnerabilities into its Known Exploited Vulnerabilities Catalog.
These additions immediately elevate the urgency for organizations that depend on affected systems, especially government agencies and critical infrastructure operators.
The vulnerabilities include:
CVE-2023-4346, affecting KNX building automation devices.
CVE-2026-46817, affecting Oracle Payments.
Although these vulnerabilities impact very different technologies, both pose serious operational risks if left unpatched.
Understanding the KNX Device Vulnerability
A Weak Lockout Mechanism Creates a Serious Risk
The first vulnerability, tracked as CVE-2023-4346, carries a CVSS severity score of 7.5.
The flaw affects KNX devices that rely on KNX Connection Authorization Option 1, a security mechanism designed to protect configuration access using a shared Building Control Unit (BCU) key.
Rather than protecting devices effectively, an attacker who gains access to the KNX network—or physically accesses a vulnerable device—can abuse this mechanism to overwrite the BCU key.
Once the key is replaced, legitimate administrators can become permanently locked out.
How the Attack Works
Availability Becomes the Main Target
Unlike many vulnerabilities that focus on stealing data, this flaw primarily impacts system availability.
An attacker can:
Connect to the vulnerable KNX network.
Configure a new BCU authorization key.
Prevent administrators from resetting or managing the device.
Disrupt building automation operations.
This attack could affect numerous automated systems, including:
Smart lighting
HVAC systems
Building security
Environmental controls
Industrial automation
In large commercial facilities or government buildings, losing administrative access could create significant operational disruptions.
Why KNX Systems Matter
Critical Infrastructure Depends on Them
KNX technology is one of the
Thousands of facilities use KNX devices to manage essential operations such as:
Office buildings
Hospitals
Airports
Hotels
Manufacturing plants
Government facilities
Because these systems often operate continuously, any disruption can lead to financial losses, service interruptions, and expensive recovery efforts.
Oracle Payments Vulnerability Raises Even Greater Concerns
Unauthenticated System Takeover
The second vulnerability, CVE-2026-46817, is arguably even more dangerous.
It affects Oracle Payments versions:
12.2.3
12.2.4
Through 12.2.15
The flaw enables an unauthenticated attacker to compromise vulnerable Oracle Payment systems remotely over HTTP.
In other words, attackers do not require valid login credentials before launching an attack.
That dramatically lowers the barrier for exploitation.
Oracle Already Released a Security Patch
Critical Patch Update Should Be Installed Immediately
Oracle addressed the vulnerability during its latest Critical Patch Update.
Security teams are strongly encouraged to deploy the available fixes without delay.
However, history repeatedly shows that many organizations postpone enterprise software updates due to:
Operational concerns
Downtime requirements
Compatibility testing
Resource limitations
Unfortunately, attackers frequently exploit that delay.
Researchers Confirm Active Exploitation
Threat Activity Has Already Begun
Earlier this month, researchers at Defused Cyber warned that attackers are actively exploiting CVE-2026-46817.
Although researchers have not publicly disclosed technical exploit details or identified the threat actors responsible, confirmation of active exploitation alone is enough to significantly increase the vulnerability’s priority.
Organizations should assume attackers are already scanning the internet for exposed Oracle Payment servers.
Waiting to patch only increases risk.
Federal Agencies Face Immediate Deadlines
CISA Issues Mandatory Remediation Timeline
Because these vulnerabilities have entered the KEV Catalog, federal civilian agencies must comply with Binding Operational Directive 22-01.
The directive requires agencies to remediate vulnerabilities before strict deadlines.
Current deadlines include:
Oracle Payments vulnerability, July 18, 2026
KNX Connection Authorization vulnerability, July 29, 2026
Failure to comply increases exposure to attacks that have already been observed in the wild.
Private Organizations Should Not Ignore the Warning
KEV Listings Affect Everyone
Although the directive specifically targets federal agencies, cybersecurity experts strongly recommend that private organizations treat KEV updates with the same urgency.
The KEV Catalog has consistently proven to be one of the strongest indicators of real-world cyber risk.
Organizations should regularly compare their vulnerability inventories against the KEV Catalog and prioritize remediation accordingly.
Ignoring actively exploited vulnerabilities significantly increases the chance of ransomware, espionage, operational disruption, or financial compromise.
Deep Analysis
Technical Investigation and Defensive Commands
Security administrators should immediately determine whether vulnerable Oracle Payments servers or KNX-related infrastructure exist within their environments.
Useful investigation commands include:
Linux Asset Discovery
nmap -sV -Pn <target-ip>
Identify HTTP Services
curl -I http://target-server
Search Oracle Services
netstat -tulpn | grep 80
Check Running Oracle Processes
ps -ef | grep oracle
Review Authentication Logs
journalctl -xe
Windows PowerShell Service Audit
Get-Service
Installed Oracle Components
Get-WmiObject Win32_Product | Select Name, Version
Network Exposure Review
ss -tulnp
Scan Internal Assets
nmap -A 192.168.1.0/24
Beyond command-line investigations, organizations should:
Patch Oracle Payments immediately.
Segment building automation networks from corporate environments.
Restrict KNX administrative access.
Enable continuous vulnerability scanning.
Review internet-facing assets.
Monitor abnormal authentication attempts.
Maintain offline backups.
Perform regular penetration testing.
Audit privileged accounts.
Track every new KEV update released by CISA.
Cybersecurity today is no longer simply about preventing unknown threats. It increasingly depends on how quickly organizations respond to threats that are already well understood.
What Undercode Say
The Real Story Is Patch Prioritization
Many organizations focus enormous resources on defending against hypothetical zero-day attacks, yet attackers consistently succeed by exploiting vulnerabilities that already have available fixes. This latest KEV update reinforces that reality.
Oracle Remains a High-Value Target
Oracle software powers financial platforms, enterprise resource planning, and payment processing across major organizations worldwide. A remotely exploitable vulnerability requiring no authentication immediately becomes attractive to cybercriminals because compromising payment infrastructure can provide both financial gain and long-term persistence.
Building Automation Is Becoming a Cybersecurity Battlefield
KNX devices may seem unrelated to traditional IT security, but modern buildings rely heavily on interconnected operational technology. Disrupting HVAC, lighting, elevators, or access control systems can create business interruptions without ever touching traditional servers.
Operational Technology Can No Longer Be Ignored
Many operational technology environments were designed primarily for reliability rather than modern cyber defense. As these systems become connected to enterprise networks, attackers increasingly treat them as entry points or disruption targets.
Active Exploitation Changes Everything
Once CISA confirms active exploitation, organizations should stop debating risk levels and begin emergency remediation. Every day that passes without patching increases the likelihood that automated scanning tools or ransomware groups will discover vulnerable systems.
Attackers Exploit Delays, Not Complexity
Cybercriminals frequently succeed because organizations delay maintenance windows, postpone upgrades, or underestimate publicly disclosed vulnerabilities. The most dangerous exploit is often the one that administrators believe can wait until next month.
The KEV Catalog Is Becoming an Industry Standard
While Binding Operational Directive 22-01 legally applies to U.S. federal civilian agencies, private enterprises increasingly use the KEV Catalog as one of their primary patch prioritization resources. It offers a practical view of which vulnerabilities are actively threatening organizations today.
Asset Visibility Remains Essential
A surprising number of organizations still lack an accurate inventory of internet-facing systems or operational technology assets. Without visibility, even the fastest patch release cannot protect systems administrators do not know exist.
Defense Requires Coordination
Security teams, network engineers, facilities managers, and executive leadership must collaborate when vulnerabilities impact both enterprise software and physical infrastructure. Cybersecurity is no longer confined to the IT department alone.
Speed Is the New Security Metric
The gap between vulnerability disclosure and exploitation continues to shrink. Organizations that reduce patch deployment time from weeks to days gain a significant defensive advantage over those relying on slow approval processes.
Prediction
(-1) Active Exploitation Will Expand Before Most Organizations Finish Patching
There is a strong possibility that attacks targeting CVE-2026-46817 will increase rapidly as more threat actors reverse-engineer Oracle’s security update. Automated scanning campaigns are also likely to search for exposed Oracle Payment systems across the internet.
At the same time, operational technology attacks against building automation systems are expected to grow as attackers recognize the value of disrupting physical infrastructure alongside traditional IT environments. Organizations that maintain continuous asset visibility, rapid patch management, and network segmentation will be in a much stronger position to withstand this evolving threat landscape.
✅ Confirmed: CISA has added CVE-2023-4346 and CVE-2026-46817 to its Known Exploited Vulnerabilities (KEV) Catalog, meaning there is evidence of real-world exploitation.
✅ Verified: Oracle has released patches for CVE-2026-46817, and CISA has directed U.S. federal agencies to remediate the vulnerability by the specified deadline under Binding Operational Directive 22-01.
✅ Accurate: Security researchers reported active exploitation of the Oracle vulnerability, although detailed technical information and attacker attribution have not been publicly disclosed, making rapid patching the most effective mitigation strategy.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
