CVE-2026-25939
CVE-2026-25939 · FUXA Unauthenticated Remote Arbitrary Scheduler Write
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
CVSS 9.3 · Critical · EPSS 12.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
fuxa
- Versions
- < 1.2.11: Affected
No fix published
fuxa-server npm
- Affected ranges
- SEMVER: ≥ 1.2.8, < 1.2.11
Update to 1.2.11