CVE

CVE-2026-25939

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

fuxa

Updated Nov 12, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

FUXA - Authorization Bypass

FUXA 1.2.8 through 1.2.10 contains an authorization bypass caused by improper access control in scheduler management, letting unauthenticated remote attackers create and modify schedulers, exploit requires no authentication. References: https://github.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fc https://github.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9b https://nvd.nist.gov/vuln/detail/CVE-2026-25939 Remediation: Upgrade to version 1.2.11 or later.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: fuxa

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →