Vulnerability details

CVE-2026-25893

frangoteam FUXA

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

CVSS 4.0

10.0Critical

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

CVSS scores

Score	Version	Source	Vector
10.0Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Affected products

Vendor	Product	Versions	Source
frangoteam	FUXA	< 1.2.10	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822 x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-10
Last updated: 2026-02-12
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.75%

Probability of exploitation in 30 days

55.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-285
Improper Authorization
CWE-287
Improper Authentication