Executive brief
PowerJob is an enterprise job scheduling middleware used to manage distributed task execution across networks. Versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the Server-Worker communication layer that allows attackers to execute arbitrary code on affected systems without requiring any credentials or authentication.
Technical details
The vulnerability exists in the /friend/process endpoint of PowerJob's Server-Worker transport layer, specifically within the FriendActor and RemoteRequestProcessor components. The vulnerability allows unauthenticated remote attackers to execute arbitrary code through unsafe deserialization or improper input handling in the GroovyEvaluator component. Attack preconditions are minimal—the endpoint is exposed by default on port 10010 (HTTP), 10086 (AKKA), and 10077 (MU) and requires no authentication, making it remotely exploitable from the network. An attacker can achieve complete code execution on the PowerJob Server. Patches are available in versions later than 5.1.2; remediation includes implementing mutual Server-Worker authentication, restricting RemoteRequestProcessor to a safe allowlist, disabling /friend/process by default, and removing remote accessibility of GroovyEvaluator.
Affected products
- PowerJob PowerJob Server 4.x through 5.1.2
Timeline
- 2026-09-04: disclosed