CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments Unauthenticated Takeover) and CVE-2023-4346 (KNX Protocol Account-Lockout) to KEV Catalog

CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments (TL-2026-1395) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-16 and last reviewed 2026-07-18. It has no confirmed attribution, affects Oracle E-Business Suite (Oracle Payments - File Transmission, references 2 CVEs (CVE-2026-46817, CVE-2023-4346), maps to 25 MITRE ATT&CK techniques (T0813, T0814, T1005), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1395

Threat ID
TL-2026-1395
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
financial services, government administration, manufacturing, critical infrastructure, technology
Target regions
Global
Detection rules
9
Indicators of compromise
21
Updates
2026-07-18 · revalidated 1× · latest source

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-07-15: CVE-2026-46817 (CVSS 9.8), an unauthenticated missing-authentication flaw in the File Transmission component of Oracle Payments (Oracle E-Business Suite 12.2.3-12.2.15) enabling arbitrary file read and full application takeover via the /OA_HTML/ibytransmit endpoint, and CVE-2023-4346 (CVSS 7.5), an overly restrictive KNX Connection Authorization Option 1 account-lockout weakness that lets network or physically present attackers permanently lock KNX building-automation devices. BOD 26-04 requires FCEB agencies to remediate both on publicly exposed assets.

How CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments works

CVE-2026-46817 is a critical (CVSS 3.1: 9.8) missing-authentication-for-critical-function vulnerability (CWE-306, with an associated improper-authentication weakness CWE-287) in the File Transmission component of Oracle Payments within Oracle E-Business Suite versions 12.2.3 through 12.2.15. An unauthenticated, remote attacker with only network access to the HTTP interface can send a crafted POST request containing XML 'DeliveryRequest' data to the /OA_HTML/ibytransmit endpoint. The request invokes an internal Oracle Java function directly, in an unauthorized context, causing the server to read and return arbitrary local files (demonstrated in the wild against /etc/passwd). The same primitive could reach EBS configuration files, database credentials, encryption keys, or payment-processor API keys, and CISA/vendor guidance characterizes the flaw as enabling a full takeover of Oracle Payments. Oracle shipped a fix in its May 2026 Critical Patch Update (published 2026-05-28). Threat-intelligence firm Defused, operating Oracle E-Business Suite decoys, recorded the first in-the-wild exploitation attempt on 2026-06-27 - roughly six weeks after the patch shipped and before any public proof-of-concept code existed - describing it as a single source running a targeted unauthenticated file-read, not broad opportunistic scanning. Public disclosure followed on 2026-06-29/30 (Help Net Security, BleepingComputer, SecurityWeek), at which point the Shadowserver Foundation reported roughly 900-950 internet-exposed Oracle E-Business Suite instances of unknown patch status. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-07-15.

CVE-2023-4346 (CVSS 3.1: 7.5, CWE-645 Overly Restrictive Account Lockout Mechanism) affects KNX Association KNX Protocol devices that implement KNX Connection Authorization and support Option 1. Devices expose a BCU (Bus Coupling Unit) key feature that can be used to set a device password, but that password frequently cannot be reset without first supplying the current password. An attacker with either network access to the KNX installation or physical access to a device can interface with the bus, purge devices lacking additional security options, and set a BCU key - permanently locking legitimate operators out of the device with no reliable recovery path. CISA published ICS Advisory ICSA-23-236-01 covering the flaw and added it to the KEV catalog on 2026-07-15 alongside CVE-2026-46817, citing confirmed exploitation.

Both CVEs were added under Binding Operational Directive 26-04 ('Prioritizing Security Updates Based on Risk', issued 2026-06-10), which requires FCEB agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets that can grant an attacker significant post-exploitation impact, with CISA's KEV entry for CVE-2026-46817 carrying a 2026-07-29 remediation due date.

MITRE ATT&CK techniques used in TL-2026-1395

impact

T0813 Denial of Control

Inhibit Response Function

T0814 Denial of Service

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1190 Exploit Public-Facing Application; T1200 Hardware Additions

Command and Control

T1205 Traffic Signaling

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1485 Data Destruction; T1489 Service Stop; T1490 Inhibit System Recovery; T1499 Endpoint Denial of Service; T1531 Account Access Removal

Persistence

T1505 Server Software Component

Credential Access

T1552 Unsecured Credentials

persistence

T1554 Compromise Host Software Binary

Resource Development

T1585 Establish Accounts; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

  • Oracle — E-Business Suite (Oracle Payments - File Transmission component)
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: 12.2.x with Oracle May 2026 Critical Patch Update applied
  • KNX Association — KNX Protocol (devices implementing Connection Authorization Option 1)
    Vulnerable versions: KNX Connection Authorization Option 1 (all conformant implementations)
    Fixed in: No vendor patch; mitigation is access-control based per CISA ICSA-23-236-01

Remediation for CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

Patches

  • Oracle May 2026 Critical Patch Update (CVE-2026-46817)
  • No software patch/reset path exists for CVE-2023-4346; mitigation is procedural (access restriction), per CISA ICS Advisory ICSA-23-236-01

Immediate actions

  • Apply Oracle's May 2026 Critical Patch Update to all Oracle E-Business Suite 12.2.3-12.2.15 instances running Oracle Payments
  • Restrict Oracle EBS web interfaces (including /OA_HTML/ibytransmit) to internal networks or VPN/allowlisted-proxy access only, not the open internet
  • Deploy WAF rules blocking unauthenticated POST requests with XML DeliveryRequest payloads to the File Transmission / ibytransmit interface
  • Audit KNX installations for devices using Connection Authorization Option 1 and restrict network and physical access to KNX bus segments
  • Inventory internet-exposed Oracle E-Business Suite instances (Shadowserver reported ~900-950 exposed instances as of 2026-06-30) and confirm patch status

Workarounds

  • Restrict Oracle EBS Payments File Transmission interface to internal/VPN-only access until patched
  • Restrict network and physical access to KNX installations using Connection Authorization Option 1

Longer-term hardening

  • Segment ERP/payment application interfaces from general network access with strict allowlisting
  • Implement credential rotation for Oracle Payments workflow accounts if unauthorized file access is suspected
  • Deploy monitoring for anomalous unauthenticated access to Oracle Payments endpoints and for reads of sensitive files (/etc/passwd, EBS config files)
  • Establish a documented physical and logical access-control policy for KNX building-automation bus segments
  • Track FCEB remediation obligations under BOD 26-04's four-variable prioritization model (public exposure, KEV listing, automatability, technical impact)

CVEs associated with CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

CVE-2026-46817, CVE-2023-4346

Weaknesses (CWE) in CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

CWE-306, CWE-287, CWE-645, CWE-269

Timeline of CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

  • CISA publishes ICS Advisory ICSA-23-236-01 documenting the KNX Connection Authorization Option 1 overly restrictive account-lockout weakness (CVE-2023-4346).
  • CVE-2026-46817 is published and fixed by Oracle in the May 2026 Critical Patch Update for Oracle E-Business Suite 12.2.3-12.2.15.
  • CISA issues Binding Operational Directive 26-04 (Prioritizing Security Updates Based on Risk), establishing the risk-based KEV remediation model later applied to both CVEs.
  • Threat-intelligence firm Defused records the first in-the-wild exploitation attempt against CVE-2026-46817 on its Oracle E-Business Suite decoy honeypots - roughly six weeks after Oracle's patch and before any public PoC existed.
  • Active exploitation of CVE-2026-46817 is publicly disclosed by Defused and covered by SecurityWeek and TheHackerNews.
  • Rescana reports post-compromise web-shell deployment, malicious JavaScript injection, zTDS-linked outbound traffic, and payroll/HR/financial-record exfiltration across 450+ internet-exposed Oracle EBS instances (roughly 200 concentrated in the US and Europe, additional exposure in Canada, Mexico, and Brazil).
  • Shadowserver Foundation reports approximately 900-950 internet-exposed Oracle E-Business Suite instances of unknown patch status; Help Net Security and BleepingComputer publish further exploitation coverage.
  • CISA adds both CVE-2026-46817 and CVE-2023-4346 to the Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of active exploitation.
  • Security Affairs publishes coverage of the dual KEV addition for CVE-2026-46817 and CVE-2023-4346.
  • Federal civilian remediation deadline cited for CVE-2026-46817 per the newer report — earlier than the 2026-07-29 due date in the existing record; unresolved discrepancy, flagged in revalidation_notes rather than overwritten.
  • CISA-mandated remediation due date for CVE-2026-46817 under BOD 26-04 for FCEB agencies with publicly exposed, KEV-listed assets.

Update history for TL-2026-1395

Sources cited for CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

Threats related to CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments

Detection coverage for TL-2026-1395

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1395 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats