SQL Injection Attack Enables Malware Deployment in Oracle Database

On July 27, 2026, Huntress detected a SQL injection attack on an Oracle database server leading to credential theft. Attackers exploited a vulnerability in a public-facing Java application, allowing them to upload a post-exploitation toolkit named 'khunt' directly into the database. This toolkit utilized Oracle's embedded Java capabilities to execute commands on the underlying Windows server, escalating from SQL injection to SYSTEM-level access. The attackers managed to dump sensitive registry hives, potentially for credential exfiltration. The incident highlights a significant shift in threat models, where the database itself becomes a host for malicious activities. Huntress emphasized the need for proper input validation and limiting database privileges to mitigate such attacks. The attack's sophistication is noted as a rare use of Java capabilities for malicious purposes within Oracle databases.

Key Points: • Attackers exploited SQL injection in a Java application to deploy khunt toolkit in Oracle DB. • The khunt toolkit enabled SYSTEM-level command execution on the Windows server. • Proper input validation and privilege restrictions are critical to prevent similar attacks.