CISA adds two exploited vulnerabilities to its catalog

Enterprise cybersecurity faces a constant challenge: the emergence of new vulnerabilities that malicious actors actively exploit before organizations can apply patches. Recently, the Cybersecurity and Infrastructure Security Agency (CISA) has updated its Catalog of Known Exploited Vulnerabilities (KEV) with two new entries, reinforcing the need to adopt proactive risk management strategies. This move not only affects federal agencies, but sends a clear signal to all companies: cybersecurity is no longer a luxury, but an operational pillar that must be integrated with technologies such as custom software, artificial intelligence, and AWS and Azure cloud services.

The added vulnerabilities correspond to CVE-2023-4346, related to the KNX Association protocol and an overly restrictive account lockout mechanism, and CVE-2026-46817, a flaw in privilege management in Oracle E-Business Suite. Both have been exploited in real environments, which makes them priority attack vectors. For companies that rely on industrial control systems or ERP platforms, these threats pose a critical risk that can compromise data integrity and business continuity. In this context, having tailored applications that include security controls by design is critical to reducing the attack surface.

Binding Operating Directive BOD 26-04, issued by the U.S. Office of Management and Budget, states that federal agencies must prioritize the remediation of vulnerabilities listed in the KEV, especially those that grant full control of the asset upon exploitation. Although this directive applies only to the federal government, its logic should inspire any organization: vulnerabilities need to be classified by risk and acted upon. Private companies, especially those that handle large volumes of data, can benefit from cybersecurity solutions that integrate artificial intelligence to detect anomalous patterns and automate responses. For example, AI agents can continuously monitor the network and alert on known CVE exploitation attempts, reducing reaction time.

The KEV catalog is constantly updated with vulnerabilities that meet three criteria: having a CVE identifier, evidence of actual exploitation, and clear mitigation guidance. CISA invites the community to report new vulnerabilities using a nomination form. This public-private collaboration is key to maintaining a safer digital ecosystem. From a business perspective, the recommendation is clear: any organization should implement a risk-based vulnerability management system, and not just react to incidents. This is where services like those offered by Q2BSTUDIO make a difference: by combining custom software development with advanced security practices, applications can be built that withstand the most common attacks and are quickly updated to new threats.

Integrating AWS and Azure cloud services into the cybersecurity strategy allows enterprises to scale their defenses flexibly. Cloud platforms offer native tools for identity management, firewalls, and intrusion detection, but their effectiveness depends on proper configuration. Many security breaches occur due to configuration errors, not vendor failures. Therefore, having specialized consulting is vital. Q2BSTUDIO helps organizations design secure cloud architectures, audit access, and apply patches in an automated manner, minimizing the risk of exposure to vulnerabilities such as those CISA has just added.

Business intelligence also plays an important role in cybersecurity. Tools such as Power BI allow you to visualize in real time the status of the systems, the frequency of attack attempts and the effectiveness of the patches applied. Business intelligence services provide dashboards that make it easier for security teams and management to make informed decisions. For example, a dashboard that correlates KEV vulnerabilities with critical business assets can automatically prioritize necessary patches. This analytics capability is especially useful when managing complex environments with multiple applications, both pre-developed and custom applications.

Enterprise AIs are transforming cybersecurity by enabling predictive threat detection. Machine learning models can learn normal network behavior and flag deviations that indicate active exploitation. In addition, AI agents can automate repetitive tasks such as log collection, event correlation, and compliance reporting. In the context of the new CISA vulnerabilities, a well-trained AI could identify attempts to exploit CVE-2023-4346 or CVE-2026-46817 before the damage is irreparable. This technology is no longer futuristic; It is available today for companies that are committed to innovation.

Patch management remains one of the most important pillars of cybersecurity, but it's not enough. Organizations should combine this practice with other defenses: network segmentation, role-based access control, data encryption, and continuous monitoring. Q2BSTUDIO offers a comprehensive approach that ranges from pentesting and security audits to the development of customized solutions that integrate with existing systems. By working with AWS and Azure cloud services, you can deploy an infrastructure that dynamically reacts to threats, automatically isolating compromised assets.

Finally, the education and awareness of the human team are equally crucial. Technical vulnerabilities are only part of the problem; Human errors, such as phishing or misconfigurations, are still the most common gateway. Investing in continuous training and tools that simplify safety management is essential. Q2BSTUDIO not only provides tailor-made software, but also advises on the implementation of security policies tailored to each business. The addition of these two vulnerabilities to the KEV catalog is a reminder that cybersecurity is an evolving process, and that companies must stay agile by adopting technologies such as artificial intelligence, business intelligence services, and AI agents to protect their most valuable assets.