Oracle Database "khunt" Post-Exploitation Toolkit Deployed via SQL Injection Without Writing Files to Disk

Scope: Oracle Database (Internet-Facing Web Applications Using JDBC Connections with Elevated Privileges)

Severity: Red

Huntress published a detailed incident response report on August 6, 2026, documenting a novel Oracle Database attack chain traced to credential-theft detections on July 27, 2026, in which attackers exploited a SQL injection flaw in an autocomplete search field of a public-facing web application that passed unvalidated input to Oracle over a JDBC connection. Rather than deploying traditional malware, the attackers fed Java source code directly to Oracle's built-in Java compiler, creating malicious stored schema objects inside the database itself that executed OS-level commands with SYSTEM privileges on the underlying Windows server, leaving no executable files on disk to trigger endpoint detection tools. This technique, tracked as the khunt toolkit, bypasses traditional file-based antivirus and EDR detection entirely, making it invisible to most security tooling that relies on file writes as an indicator of compromise. Organizations running Oracle Database with internet-facing applications must audit all JDBC connection accounts for unnecessary CREATE JAVA privileges, validate all user-supplied input before it reaches database queries, and review Oracle audit logs for unexpected Java object creation events as indicators of prior compromise.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.