CVE-2026-75431: Critical severity PowerJob Server vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs network access to the PowerJob Server authentication surface. No privileges or user interaction are required.

Q: Which deployments should be treated as exposed?

PowerJob Server 5.1.2 is affected, and earlier versions are likely affected. Deployments reachable over the network should be prioritized because the issue can be exploited remotely.

Q: Why does the JWT configuration create a serious impact?

The predictable HS256 signing key can allow an attacker to forge authentication tokens. Successful exploitation can lead to arbitrary code execution with high confidentiality and integrity impact.

Published Sep 4, 2026

Updated

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

Affected Software

1 affected component

PowerJob Server<=5.1.2

Event History

Sep 4, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs network access to the PowerJob Server authentication surface. No privileges or user interaction are required.

Which deployments should be treated as exposed?

PowerJob Server 5.1.2 is affected, and earlier versions are likely affected. Deployments reachable over the network should be prioritized because the issue can be exploited remotely.

Why does the JWT configuration create a serious impact?