CVE-2026-75429CWE-287

CVE-2026-75429

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00984 · 62.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-04T20:17Z
References (4)
https://gist.github.com/unpredictable21/dbd1791294c9a77ad0ee3d4827073966 · [email protected]https://github.com/PowerJob/PowerJob · [email protected]https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml · [email protected]https://github.com/unpredictable21/CVE-2026-75429_PowerJob_friend_process_RCE · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 04 SEP 00:00Z
    PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker…
    cvelistv5