What’s Vulnerable › Vulnerabilities

CVE-2026-25894: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-09 · updated 2026-06-17
• Weakness: CWE-321

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

Affected products

• frangoteam FUXA: before 1.2.10 — fixed in 1.2.10

How to fix

Upgrade to a fixed version: frangoteam FUXA 1.2.10. Check the vendor advisory for mitigations.

References

• https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.10
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg

Get alerted when CVE-2026-25894 or the next vulnerability affects your stack