CISA Warns of Exploited KNX and Oracle Vulnerabilities in 2026

CISA has added multiple vulnerabilities to its Known Exploited Vulnerabilities catalog, including KNX Association KNX Protocol and Oracle flaws, due to evidence of active exploitation.

Understanding the Vulnerabilities

The vulnerabilities added to the catalog include CVE-2023-4346, which affects the KNX Association KNX Protocol Connection Authorization Option 1, and various Oracle flaws. These vulnerabilities can be exploited by attackers to gain unauthorized access or execute malicious code.

Vulnerability Mechanics

The CVE-2023-4346 vulnerability is an overly restrictive account lockout mechanism, which can be exploited by attackers to brute-force passwords. The Oracle flaws, on the other hand, can be exploited using MITRE ATT&CK techniques such as exploitation of remote services.

According to CISA, these vulnerabilities have been added to the catalog based on evidence of active exploitation, highlighting the need for immediate attention and patching.

Who Is Affected

The affected products include KNX Association KNX Protocol and various Oracle products. The impact of these vulnerabilities can be significant, as they can be exploited by attackers to gain unauthorized access to sensitive systems and data.

What the Sceptics Say

Some sceptics may argue that the vulnerabilities have already been patched, and the risk of exploitation is low. However, CISA's warning highlights the need for continued vigilance and immediate patching to prevent exploitation.

How to Defend

• Apply the latest patches and updates to affected systems and software.
• Implement network segmentation and access controls to limit the attack surface.
• Monitor systems and networks for signs of exploitation and suspicious activity.

Key Takeaways

1. Security Teams: Prioritize patching and updating affected systems and software to prevent exploitation.
2. CISOs: Ensure that incident response plans are in place and that teams are prepared to respond to potential exploitation attempts.
3. Developers: Implement secure coding practices and conduct regular security testing to identify and address vulnerabilities.
4. End Users: Be aware of the potential risks and take steps to protect themselves, such as keeping software up to date and being cautious when clicking on links or opening attachments.

Sources

• Security Affairs: U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog
• The Register Security: Attackers target critical FortiSandbox flaws as CISA issues patch order
• CISA Advisories: CISA Adds Three Known Exploited Vulnerabilities to Catalog