SQL Injection in Oracle Escalates to SYSTEM Execution on Windows via Embedded Java Compilation
A real-world intrusion chain observed in active attacks shows how a simple SQL injection can escalate to full command execution on Windows with SYSTEM privileges. The pivot relies on Oracle Database and its built-in capability to load, compile, and execute Java inside the database engine, a powerful feature that significantly expands the attack surface when left enabled without proper controls.
The intrusion began with a basic SQL injection in an internet-facing application and progressed to command execution on a Windows server under SYSTEM rights. The critical turning point was not a new operating-system vulnerability but a legitimate Oracle Database function that allows Java source code to be loaded, compiled, and executed as part of the database's internal logic.
After obtaining database access, the attackers inserted Java source code, turned it into schema objects, and compiled it directly on the server. This post-exploitation method is particularly challenging for defenders because it reduces dependence on classic on-disk binaries and moves tooling inside the database engine, which is often monitored less rigorously than the operating system or web server.
The activity has been associated with an artifact named khunt, linked to telemetry from Huntress. The ultimate goal is to convert an application-level entry point into a pathway for executing actions on the host. When the Oracle process runs with elevated permissions on Windows, any execution chained from the database context can inherit very high privileges, up to SYSTEM, posing severe risks to the rest of the machine and its data.
The chain reinforces a well-known but frequently ignored principle: defense must start at the application layer. Remediation requires replacing string concatenation with parameterized queries and strict input validation. Database administrators should then evaluate whether Java support in Oracle is truly necessary; if not, it should be disabled or heavily restricted.
Security teams can improve visibility by monitoring specific signals inside Oracle, including statements and events such as CREATE JAVA SOURCE, CREATE JAVA CLASS, and compilation operations. Additional hardening steps include limiting users who can execute Java-related DDL, applying least-privilege principles to the application database account, and preventing the Oracle service from running with unnecessary Windows privileges.
Related articles
Critical Django Vulnerability CVE-2026-15307 Enables Remote Code Execution via GDALRaster Spatial Queries
The Django project has released versions 6.0.8 and 5.2.17 to address four vulnerabilities that could result in arbitrary file writes, unauthorized requests, denial of service, and cross-site scripting attacks. The most severe issue, tracked as CVE-2026-15307, impacts spatial queries that process raster data through the GDALRaster interface. Attackers can supply specially crafted values that cause the Django process to write files or initiate external connections under its own permissions, potentially leading to remote code execution in certain configurations. Exploitation is also possible through the Django admin panel when a staff user has view permissions on models containing geographic fields. The patches have been backported to the 5.2 and 6.0 branches as well as the upcoming 6.1 release candidate. In addition to fixing the flaw, the updates alter query behavior to reject dictionaries and strings that do not represent valid geometries.
Certificate Transparency Logs Fail to Block Rogue CA Man-in-the-Middle Attacks
A detailed technical analysis reveals that Certificate Transparency logs do not effectively protect users from man-in-the-middle attacks carried out with certificates issued by compromised or sloppy certificate authorities. The author attempted to verify SCT entries from real browser certificates using public CT log APIs such as get-proof-by-hash but consistently received 404 Not Found responses. Tools including Windows certutil also reported every SCT as not found in the logs. A practical proof-of-concept attack was then constructed by creating a self-signed CA that exactly replicated the certificate chain of habr.com and serving it through nginx with matching extensions and attributes. The resulting MITM connection was accepted by browsers without warnings despite HSTS, because the pre-certificate in the log differs from the presented certificate only in public key bytes. A publicly accessible demonstration was deployed on Yandex Cloud allowing anyone to test the bypass by overriding DNS for habr.com.
Progress MarkLogic Server Patched for 10 Vulnerabilities Including Seven Critical Issues
Progress Software has released security updates for its MarkLogic Server database product after disclosing ten vulnerabilities, seven of which carry CVSS v3.1 base scores of 9.0 or higher. Three flaws, tracked as CVE-2026-7329, CVE-2026-8709, and CVE-2026-9193, were each rated 9.9 and allow low-privileged users to escalate rights or access restricted data. CVE-2026-7329 enables a user holding only a REST role to obtain administrator privileges through crafted queries, granting unauthorized operations on the database. CVE-2026-8709 stems from improper handling of REST document patches and similarly permits privilege escalation, while CVE-2026-9193 arises from insufficient access controls in the Hadoop integration feature. The advisory was published on 5 August 2026 and urges immediate application of the available patches.
Critical Vulnerabilities Disclosed in NVIDIA Dynamo with Remote Attack Risks
NVIDIA has released a security advisory detailing multiple vulnerabilities affecting its Dynamo software for Linux, which provides multimodal data serving capabilities. A total of 15 CVEs were identified across different versions, with the most severe being CVE-2026-24254 rated at CVSS 9.8 as Critical due to an out-of-bounds write in multimodal serving topology that allows unauthenticated remote attacks. Additional high-severity issues include CVE-2026-24253, which can cause denial of service through out-of-bounds memory writes, and CVE-2026-47623, which stems from deserialization of untrusted data leading to potential denial of service or data tampering, both scoring 8.2. The advisory notes a possible inconsistency between the reported CVSS base score and vector string that may be corrected later. Patches have been made available, and users are urged to update immediately to mitigate the risks.