DataEase CVE-2026-40901

Exploitation requires: (1) an authenticated DataEase account (CVSS PR:L) with a path to write into the Quartz qrtz_job_details JOB_DATA column - in the documented chain this is achieved via the previewSql SQL injection, i.e. the attacker does not get direct table access for free; (2) the vulnerable stack present by default in versions <= 2.10.20 (bundled Quartz 2.3.2 plus velocity-1.7.jar → commons-collections-3.2.1 gadget on the classpath); and (3) a scheduled Quartz job whose cron trigger subsequently fires to deserialize the payload, which introduces a timing/attack-requirement dependency (reflected as AT:P). Limiting factors: it is NOT unauthenticated (needs at least low-privilege access), it is NOT a single-request RCE (it depends on the secondary SQL-injection write primitive and on a cron trigger firing), and it applies only to unpatched instances (2.10.21 fixes it). No end-user interaction is required (UI:N).

Signals are mixed and point to a serious-but-gated flaw rather than a drop-everything internet-wide emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, VC/VI/VA:H, SC/SI/SA:H) reflects network reach, no user interaction, low-privilege authentication, an attack requirement (AT:P), and total impact on both the vulnerable and subsequent system - consistent with SSVC's 'technical impact: total.' However, SSVC also marks Automatable: no and Exploitation: poc, and EPSS is only 0.40% (61st percentile), and the CVE is not listed in CISA KEV - so real-world exploitation is presently proof-of-concept, not widespread. The most important caveat is that exploitation is not standalone: it presupposes the attacker can already write to the Quartz job table, which the description ties to a separate previewSql SQL injection; this pre-condition (captured as AT:P) is what keeps this from being a trivial single-shot RCE. Net: a genuine high-severity RCE for exposed, authenticated-reachable DataEase instances, but the compound prerequisite and low EPSS argue for prompt-patching priority rather than panic.

An attacker with a low-privileged DataEase account leverages the previewSql SQL injection to write a crafted CommonsCollections6 gadget-chain blob into the JOB_DATA column of an existing entry in qrtz_job_details. On the next cron trigger, Quartz deserializes the tampered job data through an unfiltered ObjectInputStream, invoking the gadget and executing attacker commands as root inside the container. A proof-of-concept is indicated by SSVC (Exploitation: poc), so a working exploit path is documented even though no active in-the-wild exploitation is confirmed.