CVE-2026-25938 FUXA Unauthenticated Remote Code Execution in Node-RED Integration
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-25938?
CVE-2026-25938 is a critical vulnerability in frangoteam FUXA, published on 9 Feb 2026.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.
Which versions are affected by CVE-2026-25938?
2 open source packages ship an affected version, including fuxa-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | From 1.2.8 | 1.2.11 |
fuxa-server npm | From 1.2.8 | 1.2.11 |
Products include Frangoteam Fuxa.
How do I fix CVE-2026-25938?
Upgrade fuxa-server to 1.2.11 or later.
Is CVE-2026-25938 being exploited?
There is no known exploitation of CVE-2026-25938 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in frangoteam FUXA
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
- CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
Sources
Also known as GHSA-v4p5-w6r3-2x4f.