PT-2026-33364 · Apache+2 · Commons-Collections+2

Published 2026-04-16 · Updated 2026-05-25 · CVE-2026-40901

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description An authenticated attacker with the ability to write to the Quartz job table, for example via SQL injection in 'previewSql', can achieve remote code execution. The application bundles Quartz 2.3.2, which deserializes job data BLOBs from the 'qrtz job details' table using ObjectInputStream without a deserialization filter or class allowlist. By replacing a scheduled job's JOB DATA with a malicious CommonsCollections6 gadget chain payload, the attacker can execute arbitrary commands as root inside the container when the Quartz cron trigger fires. This is possible because the legacy velocity-1.7.jar includes commons-collections-3.2.1.jar, which contains the InvokerTransformer deserialization gadget chain.

Recommendations Update to version 2.10.21.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-40901

Affected Products

Commons-Collections

Dataease

Quartz

References · 5

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-gm5q-g72w-c466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40901 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://twitter.com/CVEnew/status/2045102650199322739 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tn75zg/from_auth_bypass_to_rce_a_4vulnerability_exploit · Reddit Post