4-Vulnerability Exploit Chain in DataEase My team found a 4-vulnerability exploit chain allowing unauthenticated RCE on DataEase. Combined with a previously published vulnerability (CVE-2026-23958) - these new vulns complete the attack chain, bypassing JDBC, SQL Injection and a Quartz scheduler injection that runs periodically and executes a crafted payload on the machine. We have also a video showing the exploit POC in action :) Read the full blog: http://ox.security/blog/from-auth-bypass-to-rce-a-4-vulnerability-exploit-chain-in-dataease
Post summary
The post announces a 4‑vulnerability exploitation chain against DataEase, provides a video proof‑of‑concept, and outlines technical details of the attack, but does not include a functional exploit tool, active exploitation claims, or remediation information.
