# CISA Adds CVE-2026-46817 (Oracle E-Business Suite Payments Unauthenticated Takeover) and CVE-2023-4346 (KNX Protocol Account-Lockout) to KEV Catalog

> CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-07-15: CVE-2026-46817 (CVSS 9.8), an unauthenticated missing-authentication flaw in the File Transmission component of Oracle Payments (Oracle E-Business Suite 12.2.3-12.2.15) enabling arbitrary file read and full application takeover via the /OA_HTML/ibytransmit endpoint, and CVE-2023-4346 (CVSS 7.5), an overly restrictive KNX Connection Authorization Option 1 account-lockout weakness that lets network or physically present attackers permanently lock KNX building-automation devices. BOD 26-04 requires FCEB agencies to remediate both on publicly exposed assets.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-18T23:08:19.163Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1395
- **ID:** TL-2026-1395
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46817, CVE-2023-4346

## Description

CVE-2026-46817 is a critical (CVSS 3.1: 9.8) missing-authentication-for-critical-function vulnerability (CWE-306, with an associated improper-authentication weakness CWE-287) in the File Transmission component of Oracle Payments within Oracle E-Business Suite versions 12.2.3 through 12.2.15. An unauthenticated, remote attacker with only network access to the HTTP interface can send a crafted POST request containing XML 'DeliveryRequest' data to the /OA_HTML/ibytransmit endpoint. The request invokes an internal Oracle Java function directly, in an unauthorized context, causing the server to read and return arbitrary local files (demonstrated in the wild against /etc/passwd). The same primitive could reach EBS configuration files, database credentials, encryption keys, or payment-processor API keys, and CISA/vendor guidance characterizes the flaw as enabling a full takeover of Oracle Payments. Oracle shipped a fix in its May 2026 Critical Patch Update (published 2026-05-28). Threat-intelligence firm Defused, operating Oracle E-Business Suite decoys, recorded the first in-the-wild exploitation attempt on 2026-06-27 - roughly six weeks after the patch shipped and before any public proof-of-concept code existed - describing it as a single source running a targeted unauthenticated file-read, not broad opportunistic scanning. Public disclosure followed on 2026-06-29/30 (Help Net Security, BleepingComputer, SecurityWeek), at which point the Shadowserver Foundation reported roughly 900-950 internet-exposed Oracle E-Business Suite instances of unknown patch status. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-07-15.

CVE-2023-4346 (CVSS 3.1: 7.5, CWE-645 Overly Restrictive Account Lockout Mechanism) affects KNX Association KNX Protocol devices that implement KNX Connection Authorization and support Option 1. Devices expose a BCU (Bus Coupling Unit) key feature that can be used to set a device password, but that password frequently cannot be reset without first supplying the current password. An attacker with either network access to the KNX installation or physical access to a device can interface with the bus, purge devices lacking additional security options, and set a BCU key - permanently locking legitimate operators out of the device with no reliable recovery path. CISA published ICS Advisory ICSA-23-236-01 covering the flaw and added it to the KEV catalog on 2026-07-15 alongside CVE-2026-46817, citing confirmed exploitation.

Both CVEs were added under Binding Operational Directive 26-04 ('Prioritizing Security Updates Based on Risk', issued 2026-06-10), which requires FCEB agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets that can grant an attacker significant post-exploitation impact, with CISA's KEV entry for CVE-2026-46817 carrying a 2026-07-29 remediation due date.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1200 Hardware Additions
- T1046 Network Service Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1531 Account Access Removal
- T1489 Service Stop
- T1585 Establish Accounts
- T1082 System Information Discovery
- T0813 Denial of Control
- T0814 Denial of Service
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1210 Exploitation of Remote Services
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1499 Endpoint Denial of Service
- T1505 Server Software Component
- T1554 Compromise Host Software Binary
- T1205 Traffic Signaling
- T1041 Exfiltration Over C2 Channel

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [KNX Protocol | CISA ICS Advisory ICSA-23-236-01](https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01)
- [CVE-2023-4346 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4346)
- [Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild](https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html)
- [Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817](https://securityaffairs.com/194463/security/attackers-actively-exploit-the-oracle-e-business-suite-flaw-cve-2026-46817.html)
- [Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/)
- [Over 900 Oracle E-Business instances exposed to ongoing attacks](https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/)
- [Exploitation of Recent Oracle E-Business Suite Vulnerability Begins](https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/)
- [Unauthenticated HTTP takeover in Oracle E-Business Suite Oracle Payments File Transmission (CVE-2026-46817)](https://www.mallory.ai/vulnerabilities/CVE-2026-46817)
- [Oracle EBS Flaw CVE-2026-46817 Exposes Oracle Payments to Takeover](https://socradar.io/blog/cve-2026-46817-oracle-payments-takeover/)
- [Oracle Security Alert Advisory - CVE-2026-46817 (CPU May 2026)](https://www.oracle.com/security-alerts/cspumay2026.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1395