CVE-2026-25939 FUXA Unauthenticated Remote Arbitrary Scheduler Write
Unauthenticated attackers can create or modify arbitrary schedulers in FUXA, potentially compromising connected ICS/SCADA environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25939?
CVE-2026-25939 is a critical missing authorization vulnerability in frangoteam FUXA, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
Weakness: CWE-862
Which versions are affected by CVE-2026-25939?
2 open source packages ship an affected version, including fuxa-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | From 1.2.8 | 1.2.11 |
fuxa-server npm | From 1.2.8 | 1.2.11 |
Products include Frangoteam Fuxa.
How do I fix CVE-2026-25939?
Upgrade fuxa-server to 1.2.11 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25939 being exploited?
There is no known exploitation of CVE-2026-25939 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in frangoteam FUXA
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
- CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
Sources
Also known as GHSA-c869-jx4c-q5fc.