High cybersecurity update: Hackers run khunt post-exploitation toolkit from Oracle database. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. […] Hackers run khunt post-exploitation toolkit from Oracle database Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. The attack was discovered by Huntress on July 27, 2026, after its security platform detected credential theft on a server hosting an Oracle database server. Apache access logs showed that the attackers gained access through a vulnerable search engine endpoint in a public-facing Java application running Apache Tomcat. The application failed to properly validate input submitted through an autocomplete search feature that allowed the attackers to issue SQL commands to the Oracle database. After exploiting the SQL injection flaw, the attackers installed a post-exploitation toolkit called khunt directly into the Oracle database as a Java object. Oracle has an embedded Java Virtual Machine and the CREATE JAVA SOURCE statement, which allows Java source code to be stored and compiled as a database schema object. These Java objects can then be executed via SQL commands, which if configured to do so, can execute commands on the host operating system.
Technical Details
The attackers abused this functionality to compile and store the khunt toolkit directly inside the Oracle database rather than deploying them as executable files on the server. "The use of the technique in the wild has rarely been documented," Huntress said . The toolkit contained multiple Java components and PL/SQL wrappers that could execute commands, steal credentials, and manage files. KhuntCmd , which launched cmd.exe and allowed attackers to execute operating system commands through SQL statements. KhuntHash , which accessed Oracle’s internal user table and wrote usernames and password data to a file. KhuntFS and KhuntFS2 , which provided file browsing, reading, searching, and file-size checking capabilities. KhuntT , which acted as a ping-like test to confirm that the toolkit had been successfully installed. The attackers used KhuntCmd to run cmd.exe /c whoami, confirming that commands executed through the Oracle database had SYSTEM-level permissions on the Windows server. They then used PowerShell and Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, which can be used to recover password hashes for local Windows accounts.
Security Impact
Organizations using the affected technology should treat the report according to its high severity classification. The attackers also ran tasklist /svc to enumerate running services and saved the output to khunttasks.txt. Huntress said the registry hives were likely exfiltrated for credential dumping, but the report does not confirm whether the files were successfully stolen. As a general rule, organizations should sanitize all user supplied input validation and limit the privileges granted to application database accounts. Huntress recommends that database accounts used in public-facing applications should not have high enough privileges to create Java sources, execute unnecessary stored procedures, or perform other administrative actions. Security teams log 54% of successful attacks and alert on just 14%. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. CISA orders feds to patch actively exploited Oracle flaw by Saturday Over 900 Oracle E-Business instances exposed to ongoing attacks Nissan discloses employee data breach linked to Oracle zero-day attacks Hackers now exploit critical Oracle E-Business flaw in attacks Oracle mitigates PeopleSoft zero-day exploited in data theft attacks Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: High
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
