CVE-2026-46817 & CVE-2023-4346: CISA KEV Alert — Oracle EBS & KNX Protocol Active Exploitation

---
title: Potential Oracle EBS Privilege Escalation - CVE-2026-46817
id: 8a2b3c4d-5e6f-7890-1234-5678abcdef90
status: experimental
description: Detects suspicious access patterns indicative of privilege management exploitation in Oracle E-Business Suite, focusing on admin module access by non-standard users.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/16
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: web
  product: apache
detection:
  selection_uri:
    cs-uri-query|contains:
      - '/OA_HTML/AkFindShell.jsp'
      - '/OA_HTML/OA.jsp?page='
  selection_method:
    cs-method: POST
  selection_status:
    sc-status: 200
  filter_legit:
    c-user|re: '^admin$|^sysadmin$'
  condition: selection_uri and selection_method and selection_status and not filter_legit
falsepositives:
  - Legitimate administrative testing by authorized personnel
level: high
---
title: KNX Protocol Brute Force or Anomaly - CVE-2023-4346
id: 1a2b3c4d-5e6f-7890-1234-5678abcdef91
status: experimental
description: Detects high-frequency or malformed KNX protocol traffic (UDP 3671) indicative of active exploitation attempts targeting the authorization lockout mechanism.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/16
tags:
  - attack.initial_access
  - attack.t1190
  - attack.ics
logsource:
  category: network_connection
  product: zeek
detection:
  selection_port:
    destination_port: 3671
  selection_protocol:
    protocol: udp
  selection_anomaly:
    packets|gt: 100
  timeframe: 1m
  condition: selection_port and selection_protocol and selection_anomaly
falsepositives:
  - Misconfigured KNX discovery tools
  - Heavy legitimate automation traffic during reboots
level: high

// Hunt for Oracle EBS Privilege Escalation attempts (CVE-2026-46817)
// Look for HTTP 200 responses on admin pages from non-admin IPs
let AdminPages = dynamic(['/OA_HTML/AkFindShell.jsp', '/OA_HTML/OA.jsp', '/pls/oracle']);
Syslog
| where Facility in ('Web', 'HTTP') or ProcessName contains 'httpd'
| parse Message with * "cs-uri-query=" UriQuery " " *
| parse Message with * "sc-status=" Status " " *
| parse Message with * "c-user=" User " " *
| where UriQuery has_any (AdminPages)
| where Status == '200'
| where User !~ 'admin' and User !~ 'sysadmin'
| project TimeGenerated, Computer, User, UriQuery, Message
| top 100 by TimeGenerated desc

// Hunt for KNX Protocol Anomalies (CVE-2023-4346)
// Correlate high packet counts on KNX ports
DeviceNetworkEvents
| where RemotePort == 3671
| summarize Count = count() by DeviceName, RemoteIP, bin(TimeGenerated, 1m)
| where Count > 100
| project TimeGenerated, DeviceName, RemoteIP, Count

-- Hunt for KNX related processes or unusual network utilities on OT gateways
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'knx' 
   OR Name =~ 'eibd'
   OR CommandLine =~ '3671'
   OR Name =~ 'netcat' OR Name =~ 'nc'

-- Hunt for Oracle EBS configuration files indicating version (Linux)
SELECT FullPath, Mtime, Size
FROM glob(globs='/*/u01/*/APPLTOP/*/.profile*')
WHERE Mtime > ago(date("-7d"))

#!/bin/bash
# Remediation and Detection Script for CVE-2026-46817 (Oracle EBS)
# Check for known vulnerable patch levels (Simulated Check)

echo "Checking Oracle E-Business Suite Patch Levels..."

# Define the patch ID required per July 2026 CPU (Example ID: 35984231)
REQUIRED_PATCH="35984231"
APPL_TOP="/u01/oracle/product/ebs" # Adjust to your environment

if [ -d "$APPL_TOP" ]; then
    echo "Found APPL_TOP at $APPL_TOP"
    # Example check: Querying AD patches (Simplified for demo)
    # In production, use $AD_TOP/bin/ADOP to validate patches
    if opatch lsinventory | grep -q "$REQUIRED_PATCH"; then
        echo "[PASS] Required patch $REQUIRED_PATCH is installed."
    else
        echo "[FAIL] Vulnerability CVE-2026-46817 likely present. Patch $REQUIRED_PATCH missing."
        echo "ACTION REQUIRED: Apply July 2026 Critical Patch Update immediately."
    fi
else
    echo "Oracle EBS directory not found. Check environment variables."
fi

# Check for KNX Services (CVE-2023-4346)
echo "Checking for running KNX services..."
if systemctl list-units --type=service | grep -i knx; then
    echo "[WARN] KNX services detected. Verify firewall rules block port 3671 from untrusted zones."
    echo "ACTION REQUIRED: Update KNX Gateway Firmware to patch CVE-2023-4346."
else
    echo "[INFO] No systemd KNX services found."
fi