Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Apache Tomcat Oracle SQL injection flaw under active exploitation

Vulnerability
First reported
Last updated
Happening score
H score 49
1 unique sources, 1 articles

Summary

Hide ▲

A public-facing Java application running Apache Tomcat exposed a SQL injection flaw that let attackers reach an Oracle database and stage post-exploitation tooling. The abuse was discovered on July 27, 2026 and was linked to credential theft and SYSTEM-level command execution on the host.

Related Happenings

Estée Lauder Oracle E-Business Suite personal information leak

Data Leak
H score72 First: 21.07.2026 01:39 Last: 21.07.2026 01:39 Sources 1

About this happening: A data leak exposed sensitive personal records tied to Estée Lauder after unauthorized access to its Oracle E-Business Suite used for HR management. The company sa...

Open Happening

CISA BOD 26-04 Oracle EBS patch order

Public Sector Action
H score38 First: 16.07.2026 13:56 Last: 16.07.2026 13:56 Sources 1

About this happening: CISA ordered U.S. government agencies to patch vulnerable Oracle E-Business Suite instances by Saturday, July 18, tightening federal exposure to an actively expl...

Open Happening

Oracle E-Business Suite unauth HTTP takeover security flaw (CVE-2026-46817)

Vulnerability
H score52 First: 29.06.2026 16:46 Last: 29.06.2026 16:46 Sources 1

About this happening: Oracle E-Business Suite CVE-2026-46817 is under active exploitation, putting Oracle Payments deployments at takeover risk. The flaw allows unauthenticated HTTP a...

Latest development: 16.07.2026 13:56

CISA ordered U.S. federal agencies to secure Oracle E-Business Suite systems by Saturday, July 18, after confirming active exploitation of CVE-2026-46817 and adding it to its known exploited security flaws list. Oracle E-Business Suite's Oracle Payments File Transmission component allows an unauthenticated attacker with HTTP access to compromise Oracle Payments.

Open Happening

Oracle WebLogic Server unauthenticated remote compromise flaw (CVE-2024-21182)

Vulnerability
H score59 First: 02.06.2026 15:40 Last: 02.06.2026 15:40 Sources 1

About this happening: CVE-2024-21182 in Oracle WebLogic Server is actively exploited and can let a network-access attacker achieve unauthenticated remote compromise. The flaw affect...

Open Happening

CISA orders federal patching of Oracle WebLogic CVE-2024-21182

Public Sector Action
H score53 First: 02.06.2026 15:40 Last: 02.06.2026 15:40 Sources 1

About this happening: CISA ordered federal agencies to patch Oracle WebLogic Server against CVE-2024-21182 by June 4, creating an immediate remediation deadline for affected government...

Open Happening

Timeline

  1. 05.08.2026 22:55 1 articles · 1h ago

    Credential theft is detected on an Oracle database server

    Detection Ioc Update

    Huntress detected credential theft on July 27, 2026 on a server hosting an Oracle database server after Apache access logs showed attackers reached a vulnerable search engine endpoint and autocomplete search feature in a public-facing Java application running Apache Tomcat. The requests were traced to 178.162.151[.]229, and the SQL injection path let the attackers issue SQL commands to the Oracle database.

    Show sources
    Open in new tab
  2. 05.08.2026 22:55 2 articles · 1h ago

    khunt is embedded directly inside Oracle as a Java object

    Technical Analysis Update

    Huntress detailed that after SQL injection, the attackers stored the khunt toolkit directly inside Oracle as a Java object rather than deploying executable files on the server, then used KhuntCmd to run cmd.exe /c whoami and confirm SYSTEM-level permissions on the Windows server. The toolkit also included KhuntHash for writing usernames and password data, KhuntFS and KhuntFS2 for file browsing and search, KhuntT for installation checks, and KhuntUnzip for extracting compressed files; the attackers also copied the SAM, SECURITY, and SYSTEM registry hives and ran tasklist /svc to enumerate services.

    Show sources
    Open in new tab