CVE-2026-25893: FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-09 · updated 2026-06-17
Weakness: CWE-285

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

Affected products

frangoteam FUXA: before 1.2.10 — fixed in 1.2.10

How to fix

Upgrade to a fixed version: frangoteam FUXA 1.2.10. Check the vendor advisory for mitigations.

References

https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb
https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822

Get alerted when CVE-2026-25893 or the next vulnerability affects your stack