PT-2026-7183 · Fuxa · Fuxa

Wodzen · Published 2026-02-09 · Updated 2026-03-03 · CVE-2026-25939

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FUXA versions 1.2.8 through 1.2.10

Description FUXA is a web-based Process Visualization software used in SCADA/HMI/Dashboard systems. An authorization bypass allows a remote, unauthenticated attacker to create and modify schedulers. This can expose connected ICS/SCADA environments to further malicious actions. The vulnerability exists due to insufficient access controls.

Recommendations Update to FUXA version 1.2.11 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25939

GHSA-C869-JX4C-Q5FC

Affected Products

Fuxa

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25939.json · Exploit
• https://github.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9b · Patch
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25939 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25939 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c869-jx4c-q5fc · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/pull/2174 · Note
• https://github.com/frangoteam/FUXA/commit/aced6ad0b6089eea4e5cef51c0a88bf4f308d45f · Note
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.11 · Note
• https://t.me/CVEtracker/44242 · Telegram Post
• https://twitter.com/_cvereports/status/2021051518435168510 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://twitter.com/TuringCyberObs/status/2028801692876091500 · Twitter Post
• https://twitter.com/CVEnew/status/2020995942569345510 · Twitter Post