CVE-2026-25939

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25939
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25939.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25939
Aliases
Published
2026-02-09T22:21:03.611Z
Modified
2026-03-03T01:22:55.071508Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H CVSS Calculator
Summary
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Details

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25939.json",
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/frangoteam/fuxa

Affected ranges

Type
GIT
Repo
https://github.com/frangoteam/fuxa
Events
Introduced
5d8463f5d1cf6fac512ff3f4c6889901330c4c21
Fixed
23abdb8291cfd94df7f1982f68ba4fe146e6073b

Affected versions

v1.*
v1.2.10
v1.2.8
v1.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25939.json"