Powerjob EUVD-2026-19896

This vulnerability presents substantial real-world risk despite a moderate CVSS v4.0 score of 6.9. The CVSS vector confirms unauthenticated remote attack (AV:N, PR:N, UI:N), no complexity requirements (AC:L), and limited immediate confidentiality/integrity impact in the base vector (VC:L, VI:L, VA:L). However, the RCE/Code Injection tags and CWE-94 classification indicate the actual technical impact is complete system compromise-the low impact ratings in CVSS v4.0 appear to reflect conservative scoring rather than the severity of code execution. The SSVC decision framework rates Exploitation as 'none' (no confirmed active exploitation), Automatable as 'no' (requires crafted payload), and Technical Impact as 'partial,' which aligns with the moderate CVSS but underestimates post-exploitation risk. The lack of vendor response to early disclosure and the presence of three consecutive vulnerable versions (5.1.0-5.1.2) suggest prolonged exposure risk in production environments. Organizations running PowerJob should treat this as a critical patch-now priority despite the 6.9 CVSS, as unauthenticated RCE via code injection is a foundational attack surface.

An attacker discovers a PowerJob instance running version 5.1.0-5.1.2 exposed on a public IP or internal network. The attacker crafts an HTTP POST request to /openApi/addWorkflowNode with a malicious Groovy expression embedded in the nodeParams argument, such as code that instantiates a ProcessBuilder to execute shell commands. Since no authentication is required (PR:N) and the endpoint directly passes nodeParams to GroovyEvaluator.evaluate(), the malicious code executes on the server with the privileges of the PowerJob process-typically application-level or service account privileges. The attacker could then establish reverse shell access, steal secrets from the job scheduler, or pivot to downstream systems depending on network segmentation. No public exploit code has been confirmed, but the attack surface is straightforward and requires only standard HTTP tooling to execute.