Hackers exploited an SQL injection flaw to breach a corporate network by installing a post-exploitation toolkit directly inside an Oracle database, according to a report from Huntress. The attack was discovered on July 27, 2026, after Huntress detected credential theft on a server running an Oracle database.
The attackers gained access through a vulnerable autocomplete search feature in a public-facing Java application hosted on Apache Tomcat. The flaw allowed them to send SQL commands to the Oracle database.
After gaining access, the attackers installed a toolkit called khunt as a Java object inside the Oracle database. Oracle's built-in Java Virtual Machine allows Java code to be stored and executed from the database, enabling attackers to run operating system commands without placing files directly on the server. Huntress said this technique has rarely been seen in real-world attacks.
The toolkit included tools for running system commands, browsing files, extracting archives, and accessing Oracle user data. The attackers used it to confirm they had SYSTEM-level access on the Windows server before copying Windows registry files that can be used to recover password hashes. They also collected information about running services on the system.
Huntress said it could not confirm whether the stolen registry files were successfully exfiltrated. The company recommends that organizations properly validate user input and limit database account privileges to prevent attackers from creating Java objects or performing unnecessary administrative actions.