CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
Unauthenticated attackers can execute arbitrary code via script test mode bypass in FUXA SCADA software when secure mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43947?
CVE-2026-43947 is a high-severity authentication bypass vulnerability in frangoteam FUXA, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.
Weakness: CWE-863
Which versions are affected by CVE-2026-43947?
2 open source packages ship an affected version, including fuxa-server.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | From 1.3.0 | 1.3.1 |
fuxa-server npm | From 1.3.0 | 1.3.1 |
How do I fix CVE-2026-43947?
Upgrade fuxa-server to 1.3.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-43947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43947 exists.
Sources
Also known as GHSA-rg3m-cfq7-g6h6.