CVE-2026-25939
Published: 09 February 2026
Summary
CVE-2026-25939 is a critical-severity Missing Authorization (CWE-862) vulnerability in Frangoteam Fuxa. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-25939 is an authorization bypass vulnerability (CWE-862) affecting FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) software. The issue impacts versions 1.2.8 through 1.2.10, where attackers can bypass authentication controls to create and modify arbitrary schedulers. It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), highlighting its critical severity due to high integrity and availability impacts with no privileges required.
An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation enables the creation and modification of schedulers, potentially disrupting or manipulating connected ICS/SCADA environments and enabling follow-on actions such as unauthorized control or denial of service.
Mitigation is available in FUXA version 1.2.11, which patches the authorization bypass. Security practitioners should upgrade to this version immediately. Relevant advisories and details are provided in the GitHub security advisory (GHSA-c869-jx4c-q5fc), the release notes for v1.2.11, and the patching commit (5782b35117a9bd14ffcb881f8dfb8c6680157d9b).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6250
Vulnerability details
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has…
more
been patched in FUXA version 1.2.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in public-facing FUXA web app directly enables remote unauthenticated exploitation per T1190; scheduler modification is an application-specific abuse rather than a standard Enterprise technique like T1053.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources like schedulers, directly preventing unauthenticated bypass exploitation in FUXA.
Requires timely remediation of the specific authorization bypass flaw via patching to FUXA version 1.2.11.
Explicitly authorizes and monitors any permitted actions without authentication, preventing unauthorized scheduler creation and modification.