PT-2026-7184 · Fuxa · Fuxa

Wodzen · Published 2026-02-05 · Updated 2026-02-10 · CVE-2026-25893

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.2.10

Description FUXA is a web-based Process Visualization software. A flaw exists where an unauthenticated, remote attacker can gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This is possible when the runtime.settings.secureEnabled setting is set to true. Exploitation involves minting administrator JWTs through the heartbeat refresh endpoint, allowing interaction with administrative APIs and potential full system compromise, which could impact connected ICS/SCADA environments. The API endpoint involved is the heartbeat refresh API.

Recommendations Update to FUXA version 1.2.10 or later.

Exploit

Fix

RCE

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

Related Identifiers

CVE-2026-25893

GHSA-VWCG-C828-9822

Affected Products

Fuxa

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25893.json · Exploit
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822 · Patch
• https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25893 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25893 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vwcg-c828-9822 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://twitter.com/CCBalert/status/2021250995561300088 · Twitter Post
• https://t.me/cveNotify/151493 · Telegram Post
• https://t.me/CVEtracker/44244 · Telegram Post
• https://twitter.com/CVEnew/status/2020995940925178311 · Twitter Post