by Kastro
Paper/Archive/CVE-2026-25939

CVE-2026-25939

frangoteam FUXA — FUXA Unauthenticated Remote Arbitrary Scheduler Write

EPSS 13%CVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 96.3.963 × 2019.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Affected

ProductAffectedFixed inSource
FUXA< 1.2.11–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fcrefgithub.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9brefgithub.com/frangoteam/FUXA/releases/tag/v1.2.11