CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog, including an Oracle E-Business Suite privilege management flaw that poses risks to healthcare organizations using the platform for financial and HR operations.
Tracked as CVE-2026-46817, the Oracle E-Business Suite vulnerability is an improper privilege management issue with evidence of active exploitation. Many large healthcare systems and hospital networks rely on Oracle EBS for billing, supply chain management, human resources, and financial reporting, making this a priority patching target for healthcare CISOs.
The second addition is CVE-2023-4346, an overly restrictive account lockout mechanism vulnerability in the KNX Association KNX Protocol. KNX is a building automation protocol used in smart hospitals for lighting, HVAC, and access control systems. The vulnerability could allow an attacker to purge all devices without additional security options.
Binding Operational Directive 26-04 requires federal agencies to rapidly remediate high-risk KEV vulnerabilities, and CISA urges all organizations to adopt similar risk-based prioritization. Healthcare organizations using Oracle EBS should verify their patch status against CVE-2026-46817 and assess whether building management systems using the KNX protocol are exposed.
The additions come amid a sustained increase in vulnerability exploitation across the healthcare sector, with CISA reporting that the median time from disclosure to exploitation has shrunk dramatically as attackers increasingly use AI-assisted tooling.
