CVE-2026-25939
Critical · 9.1CVSS
9.1
EPSS
0.9%
Published
Feb 9, 2026
CISA due date
—
The record
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fuxa-server | 1.2.8 | 1.2.11 |
Related vulnerabilities
- GHSA-c869-jx4c-q5fc FUXA Unauthenticated Remote Arbitrary Scheduler Write Same vulnerability
- CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
- CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
- CVE-2026-47721 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
- GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via… Also affects fuxa-server
- GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of… Also affects fuxa-server
- GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with… Also affects fuxa-server
- GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server