CVE-2026-25939: FUXA authorization bypass in scheduler endpoint

CVE-2026-25939 · Severity: medium · CVSS 4 · Published 2026-02-10

FUXA is an industrial control and SCADA visualization platform used to monitor and control connected devices and infrastructure. An unauthenticated attacker can bypass authorization checks to create, modify, or delete schedules that automatically execute actions on connected industrial equipment—potentially forcing devices into unsafe states or executing malicious commands without any authentication requirement.

Technologies: Frangoteam FUXA, fuxa-server (npm). Vendors: Frangoteam, npm.

Quick answers

Is CVE-2026-25939 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25939 being exploited in the wild.
How severe is CVE-2026-25939?
Medium severity, with a CVSS score of 4, published 10 February 2026.
Which products and versions are affected?
Frangoteam FUXA 1.2.8 through 1.2.10; fuxa-server (npm) SEMVER:introduced=1.2.8,fixed=1.2.11.
Is there a fix for CVE-2026-25939?
Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25939 attacked?
It is attacked over the network.
Am I affected by CVE-2026-25939?
Check whether you run Frangoteam FUXA or fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fuxa-server (npm): upgrade to 1.2.11 or later
    npm install fuxa-server@1.2.11

Technical details

This is an authorization bypass vulnerability (CWE-862) in FUXA's scheduler endpoint that allows unauthenticated, remote attackers to automatically authenticate as guest and manipulate scheduling rules. The attack requires no network authentication, credentials, or user interaction—only network reachability to the FUXA service. An attacker can create or modify schedules to trigger immediately or cyclically, forcing connected ICS/SCADA devices to specific states or executing existing scripts on the server. This affects versions 1.2.8 through 1.2.10; the vulnerability has been patched in version 1.2.11.

Affected products

  • Frangoteam FUXA 1.2.8 through 1.2.10

Identifiers

  • CVE-2026-25939
  • GHSA-c869-jx4c-q5fc

Timeline

  • 2026-02-09: disclosed: Advisory published on GitHub
  • 2026-02-10: patched: Fixed in version 1.2.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.