CISA Adds KNX Protocol CVE-2023-4346 to KEV Catalog

CISA placed the vulnerability tracked as CVE-2023-4346 into its Known Exploited Vulnerabilities catalog. The entry targets KNX Association KNX Protocol Connection Authorization Option 1, which reportedly features an overly restrictive account lockout mechanism.

The flaw could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. According to the catalog description, this issue might enable adversaries to wipe devices lacking further protections and then apply a BCU key that prevents normal operation.

Catalog officials recorded the addition on 2026-07-15. Federal agencies face a remediation deadline of 2026-07-29.

Required action centers on vendor mitigations and BOD 26-04 compliance. Agencies must follow vendor-provided guidance while meeting CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk directive and its Forensics Triage Requirements. Each organization bears responsibility for assessing internet-facing assets and applying the mandated patching rules.

For cloud environments the same BOD 26-04 rules apply; products without workable fixes should be taken out of service. The directive itself stresses risk-based prioritization of security updates.

Related Oracle E-Business Suite vulnerability also added the same day. The catalog entry for CVE-2026-46817 describes an Oracle E-Business Suite Improper Privilege Management Vulnerability. It allows unauthenticated takeover of Oracle Payments.