CVE-2026-47717 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Unauthenticated attackers can access sensitive project configurations and server-side scripts via the API, exposing SCADA device details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47717?
CVE-2026-47717 is a high-severity vulnerability in frangoteam FUXA, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
Weakness: CWE-201
Which versions are affected by CVE-2026-47717?
2 open source packages ship an affected version, including fuxa-server.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | From 1.3.0 | 1.3.1 |
fuxa-server npm | From 1.3.0 | 1.3.1 |
How do I fix CVE-2026-47717?
Upgrade fuxa-server to 1.3.1 or later.
Is CVE-2026-47717 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47717 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-q3w6-q3hc-c5x6.