Oracle's July 2026 security update included 1,449 patches, yet none would have stopped a credential-theft attack on an Oracle database server documented by security firm Huntress. The incident began with a straightforward SQL injection against a public-facing web application, but attackers then used a legitimate Oracle database feature to plant a post-exploitation toolkit, highlighting a shift towards abusing built-in functionality rather than exploiting software flaws.

The attackers fed CREATE JAVA SOURCE commands through a Tomcat connection to Oracle's embedded Java Virtual Machine, allowing malicious Java code to be compiled and stored directly as a database object, a technique known as oraexec that has rarely been seen exploited in the wild before. Craig Savage of Oracle support vendor Spinnaker Support said the ability to compile and run Java code should never be enabled on a production web server and should be restricted to database administrators, noting the breach resulted from poor configuration rather than an Oracle vulnerability. He warned that criminal groups increasingly understand and exploit legitimate product functionality, not just bugs, urging organisations to focus on basic security hygiene alongside patching.