PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer. An attacker who can send a request to that endpoint can execute arbitrary commands on the underlying host, thereby compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects PowerJob Server-Worker components deployed with 4.x and 5.1.2 releases. The specific endpoint that is compromised is the /friend/process path exposed by the Server-Worker transport layer.

The CVSS severity for this issue is not publicly listed, and EPSS data is unavailable, but the lack of authentication requirements makes exploitation straightforward for network‑reachable attackers. Because the issue is not listed in the CISA KEV catalog, there are no known active exploits reported at this time, though the potential for abuse remains high. The likely attack vector is remote over the network, and any user without proper network controls could exploit it.