Attackers have successfully compromised an organization's Oracle database using a SQL injection flaw in a web application, facilitating SYSTEM-level access on a Windows server without leaving traditional executable files on disk. By exploiting an unvalidated input field in the application that communicated with the database via Java Database Connectivity, the attackers were able to introduce Java source code directly into the database. This source code was then compiled into stored schema objects within Oracle, allowing the execution of commands from within the database engine itself.
Huntress, a cybersecurity firm tracking the toolkit known as askhunt, initiated an investigation following the detection of credential theft on July 27, 2026. They traced the activity back to this sophisticated attack method. The lack of validation allowed the attackers to exploit the autocomplete search field, which had enough privileges to create Java objects. Importantly, Oracle has not released patches addressing either the application flaw or the account privileges that facilitated this breach.
The embedded Java Virtual Machine in Oracle and the CREATE JAVA SOURCE statement were instrumental in this attack, allowing the attackers to compile Java code into schema objects. These objects were not traditional files or processes, making them difficult to detect using standard endpoint detection tools. The compromised account had sufficient privileges to execute this chain of attacks, a method that dates back at least two decades.
Despite observing the staging of files locally, Huntress could not confirm their exfiltration. The malicious activity was traced to a specific IP address, but no specific threat actor was identified. To mitigate such risks, it's crucial to implement parameterized queries and rigorous input validation in applications. Additionally, maintaining the principle of least privilege is essential, ensuring that public-facing application accounts do not have unnecessary permissions to create Java sources or run stored procedures.