KHunt Toolkit Turns Oracle SQL Injection Into SYSTEM

Gbhackers •Mayura Kathir • August 6, 2026

KHunt shows how a “routine” SQL injection against an Oracle‑backed web app can be weaponized into SYSTEM‑level remote code execution and credential theft by compiling a full post‑exploitation toolkit directly inside the database engine. This incident materially shifts the Oracle threat model: the database itself becomes attacker infrastructure, not just a data store. Subsequent triage […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Attack Enables Malware Deployment in Oracle Database On July 27, 2026, Huntress detected a SQL injection attack on an Oracle database server leading to credential theft. Attackers exploited a vulnerability in a public-facing Java application, allowing them to upload a post-exploitation toolkit named 'khunt' directly into the database. This toolkit utilized Oracle's embedded Java capabilities to execute commands on the underlying Windows server, escalating from SQL injection to SYSTEM-level access. The attackers managed to dump sensitive registry hives, potentially for credential exfiltration. The incident highlights a significant shift in threat models, where the database itself becomes a host for malicious activities. Huntress emphasized the need for proper input validation and limiting database privileges to mitigate such attacks. The attack's sophistication is noted as a rare use of Java capabilities for malicious purposes within Oracle databases. 8 sources 71

Extracted Entities

KHunt Toolkit Turns Oracle SQL Injection Into SYSTEM

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (2)