PT-2026-7182 · Fuxa+1 · Fuxa+1

Wodzen · Published 2026-02-09 · Updated 2026-02-12 · CVE-2026-25938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA versions 1.2.8 through 1.2.10

Description FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authentication bypass in FUXA allows a remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. The issue stems from a failure to verify JWT tokens on proxied routes. Exploitation involves sending a crafted request to the /nodered/flows API endpoint, bypassing authentication checks and granting administrative access to the Node-RED deployment API. Submitting a malicious flow configuration can then lead to arbitrary code execution in the context of the FUXA service.

Recommendations Update FUXA to version 1.2.11 or later.

Exploit

Fix

RCE

Authentication Bypass by Spoofing

Missing Authentication

Weakness Enumeration

CWE-290

CWE-306

Related Identifiers

CVE-2026-25938

GHSA-V4P5-W6R3-2X4F

Affected Products

Fuxa

Node-Red Plugin

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25938.json · Exploit
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f · Vendor Advisory
• https://github.com/frangoteam/FUXA/commit/5e7679b09718534e4501a146fdfe093da29af336 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25938 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25938 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v4p5-w6r3-2x4f · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.11 · Note
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://twitter.com/UndercodeUpdate/status/2021808932407128234 · Twitter Post
• https://twitter.com/pulsepatchio/status/2021240923116667333 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021078615069163882 · Twitter Post
• https://t.me/CVEtracker/44241 · Telegram Post
• https://twitter.com/_cvereports/status/2021059071873331539 · Twitter Post