Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Khunt Oracle database post-exploitation toolkit analysis

Technical Analysis
First reported
Last updated
Happening score
H score 22
1 unique sources, 1 articles

Summary

Hide ▲

Researchers found khunt compiled and stored as Oracle schema objects, turning the database into a stealthy platform for command execution and credential dumping on the underlying Windows server. The entry path used SQL injection in a public-facing Java application on Apache Tomcat, then leveraged Oracle's embedded Java runtime to compile attacker-supplied code inside the database. The placement inside database objects reduced visibility for conventional endpoint tooling that focuses on files, binaries, and processes.

Related Happenings

Apache Tomcat Oracle SQL injection flaw under active exploitation

Vulnerability
H score49 First: 05.08.2026 22:55 Last: 05.08.2026 22:55 Sources 1

About this happening: SQL injection in a public-facing Java application running Apache Tomcat let attackers reach an Oracle database and load the khunt toolkit as database-stored Java...

Open Happening

Estée Lauder Oracle E-Business Suite personal information leak

Data Leak
H score72 First: 21.07.2026 01:39 Last: 21.07.2026 01:39 Sources 1

About this happening: A data leak exposed sensitive personal records tied to Estée Lauder after unauthorized access to its Oracle E-Business Suite used for HR management. The company sa...

Open Happening

Oracle E-Business Suite May 2026 Critical Security Patch Update (CVE-2026-46817)

Security Patch Release
H score53 First: 29.06.2026 16:46 Last: 29.06.2026 16:46 Sources 1

About this happening: Oracle's May 2026 Critical Security Patch Update addressed CVE-2026-46817 in Oracle E-Business Suite, a critical flaw in Oracle Payments that could let an...

Latest development: 16.07.2026 13:56

CISA ordered U.S. federal agencies to secure Oracle E-Business Suite systems by Saturday, July 18, after confirming ongoing attacks against CVE-2026-46817 in Oracle Payments. Defused said it observed exploitation on Oracle E-Business honeypots over the weekend, and Oracle had already released the May 2026 Critical Security Patch Update for the flaw.

Open Happening

Oracle E-Business Suite unauth HTTP takeover security flaw (CVE-2026-46817)

Vulnerability
H score52 First: 29.06.2026 16:46 Last: 29.06.2026 16:46 Sources 1

About this happening: Oracle E-Business Suite CVE-2026-46817 is under active exploitation, putting Oracle Payments deployments at takeover risk. The flaw allows unauthenticated HTTP a...

Latest development: 16.07.2026 13:56

CISA ordered U.S. federal agencies to secure Oracle E-Business Suite systems by Saturday, July 18, after confirming active exploitation of CVE-2026-46817 and adding it to its known exploited security flaws list. Oracle E-Business Suite's Oracle Payments File Transmission component allows an unauthenticated attacker with HTTP access to compromise Oracle Payments.

Open Happening

Oracle WebLogic Server unauthenticated remote compromise flaw (CVE-2024-21182)

Vulnerability
H score59 First: 02.06.2026 15:40 Last: 02.06.2026 15:40 Sources 1

About this happening: CVE-2024-21182 in Oracle WebLogic Server is actively exploited and can let a network-access attacker achieve unauthenticated remote compromise. The flaw affect...

Open Happening

Timeline

  1. 05.08.2026 03:00 1 articles · 1d ago

    Credential-theft alerts expose intrusion on an Oracle database server

    Detection Ioc Update

    Huntress detected the intrusion on July 27 after credential-theft alerts fired on a host running an Oracle database server; Apache access logs later tied the requests to a single IP address.

    Show sources
    Open in new tab
  2. 05.08.2026 03:00 2 articles · 1d ago

    Oracle compiles khunt into schema objects for command execution

    Technical Analysis Update

    Huntress described khunt, a post-exploitation toolkit compiled and stored inside Oracle schema objects after SQL injection in the autocomplete search feature of a public-facing Java application on Apache Tomcat. Oracle's embedded JVM compiled attacker-supplied Java source into database objects, and the toolkit included a Windows command shell, a credential dumper, file explorers, an unzip utility, a reachability check, and PL/SQL wrappers while the attacker reached SYSTEM-level privileges and staged SECURITY, SYSTEM, and SAM hives for credential dumping and probable exfiltration.

    Show sources
    Open in new tab