PT-2026-7185 · Fuxa · Fuxa

Wodzen · Published 2026-02-05 · Updated 2026-03-07 · CVE-2026-25894

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA versions through 1.2.9

Description FUXA is a web-based Process Visualization software. An insecure default configuration allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This occurs when authentication is enabled, but the administrator JWT secret is not configured. Exploitation involves forging JWTs to bypass authentication mechanisms and obtain administrative access. With elevated privileges, an attacker can interact with administrative APIs to execute arbitrary code within the FUXA service, potentially leading to full system compromise and impacting connected ICS/SCADA environments.

Recommendations Update FUXA to version 1.2.10.

Exploit

Fix

RCE

Weakness Enumeration

CWE-321

CWE-1188

Related Identifiers

CVE-2026-25894

GHSA-32CC-X95P-FXCG

Affected Products

Fuxa

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25894.json · Exploit
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg · Vendor Advisory
• https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25894 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25894 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32cc-x95p-fxcg · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.10 · Note
• https://twitter.com/CVEnew/status/2020995940052877819 · Twitter Post
• https://t.me/CVEtracker/44245 · Telegram Post
• https://twitter.com/CCBalert/status/2021250995561300088 · Twitter Post
• https://t.me/cveNotify/151494 · Telegram Post
• https://twitter.com/offseq/status/2021033929675776180 · Twitter Post
• https://twitter.com/dailycve/status/2030130069952237933 · Twitter Post