CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode
Attackers can access protected SCADA data via guest or invalid tokens when secure mode is enabled, exposing sensitive operational information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47718?
CVE-2026-47718 is a medium-severity missing authorization vulnerability in frangoteam FUXA, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Which versions are affected by CVE-2026-47718?
2 open source packages ship an affected version, including fuxa-server.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | From 1.3.0-2773 | 1.3.1 |
fuxa-server npm | From 1.3.0-2773 | 1.3.1 |
How do I fix CVE-2026-47718?
Upgrade fuxa-server to 1.3.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47718 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47718 exists.
Sources
Also known as GHSA-r9g5-7q8j-958c.