Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Summary: Attackers used a SQL injection flaw in a public-facing web application's autocomplete search field to enter an Oracle database over a JDBC connection, then fed Java source code to the database so Oracle compiled it into stored schema objects and ran commands from inside the engine. Huntress, which tracks the toolkit as khunt, investigated after credential-theft detections fired on July 27, 2026, and traced the chain to SYSTEM-level code execution on the underlying Windows server, with six Java objects and several khunt_* PL/SQL wrappers running cmd.exe /c whoami to return SYSTEM.
What you should know: The toolkit is not a process, binary, or file on disk, so endpoint detection and response products do not generally inspect Oracle's internals, and no Oracle patch closes either the application flaw or the account privilege behind it. The account serving a public-facing app had enough privilege to author Java sources and run stored procedures, which is the gap least privilege would have closed.

Read the original at The Hacker News ↗