U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog

KNX Association KNX devices configured with Connection Authorization Option 1 can be locked out by an attacker because the BCU key (the device password) typically cannot be removed without entering the current password (CWE-645, an overly restrictive lockout mechanism). An attacker with access to the network used by the KNX installation can connect, purge all devices that lack additional security options, and set a BCU key; an attacker with physical access can do the same even on non-networked devices. The result is loss of availability: legitimate users are locked out of the device and often cannot reset it themselves (CVSS 7.5, availability impact only). Any deployment of KNX devices using the Connection Authorization Option 1 feature is affected; no specific firmware version ranges were published in the available data. CISA added the issue to its Known Exploited Vulnerabilities catalog on 2026-07-15, confirming exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown.

Do: Per CISA's KEV listing and BOD 26-04 requirements, apply mitigations in line with vendor instructions: inventory KNX devices using Connection Authorization Option 1, restrict network access to KNXnet/IP interfaces and remote-access paths, and keep a documented copy of any BCU keys so devices can be unlocked. Review whether the connection authorization feature can be disabled or replaced with vendor-recommended more secure options; if mitigations are unavailable, follow BOD 26-04 guidance, including discontinuing use of internet-reachable KNX interfaces.

Oracle E-Business Suite contains a critical improper privilege management flaw (CVE-2026-46817) in the File Transmission component of Oracle Payments, affecting versions 12.2.3 through 12.2.15. The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger it, with no credentials or user interaction required. Successful exploitation results in takeover of Oracle Payments, with high confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Organizations running the affected E-Business Suite releases — especially those exposing the Payments/File Transmission interface to untrusted networks — are in scope. The issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-15, researchers have observed exploitation in the wild, and EPSS assigns a 13% probability of exploitation within 30 days (96th percentile).

Do: Apply the remediation provided in Oracle's security advisory for CVE-2026-46817 to all Oracle E-Business Suite 12.2.3–12.2.15 environments running Oracle Payments, and in the meantime restrict HTTP/network access to the File Transmission component. Because the flaw is being actively exploited, review EBS/Payments access logs for unauthenticated requests and anomalous file-transmission activity to check for compromise. Federal agencies must apply mitigations in line with CISA BOD 26-04 timelines or discontinue use of the product if mitigations are unavailable.