Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25939FUXA Unauthenticated Remote Arbitrary Scheduler Write

Critical 9.3

In plain English

A critical-severity missing authorization in FUXA from frangoteam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.5% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)12.5%top 3.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fuxa-server	1.2.11	GHSA-c869-jx4c-q5fc

Affected products (as reported)

Vendor	Product	Versions
frangoteam	FUXA	< 1.2.11

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fc x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9b x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.2.11 x_refsource_MISC