CVE-2026-47721: Frangoteam FUXA privilege escalation in Scheduler API

CVE-2026-47721 · Severity: medium · CVSS 6.3 · Published 2026-08-18

FUXA is a web-based SCADA system used to monitor and control industrial equipment like PLCs. A security flaw in the scheduling component allows users with low-level 'operator' access to perform administrative actions, such as changing industrial device settings or running server scripts. This could allow an unauthorized user to disrupt industrial processes, bypass safety interlocks, or gain persistent control over the automation environment.

Technologies: Frangoteam FUXA, fuxa-server (npm). Vendors: Frangoteam, npm.

Quick answers

Is CVE-2026-47721 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47721 being exploited in the wild.
How severe is CVE-2026-47721?
Medium severity, with a CVSS score of 6.3, published 18 August 2026.
Which products and versions are affected?
Frangoteam FUXA <= 1.1.14-1243; fuxa-server (npm) <= 1.1.14-1243, SEMVER:introduced=0,last_affected=1.1.14-1243.
Is there a fix for CVE-2026-47721?
A patch was published on 2026-06-08: Fix confirmed in version 1.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47721 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47721?
Check whether you run Frangoteam FUXA or fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) in the FUXA Scheduler API allows authenticated users with non-administrative roles to create or modify scheduled tasks. By submitting crafted requests to the POST or DELETE /api/scheduler endpoints, an attacker can schedule privileged operations such as 'setTagValue' (writing to PLCs) or 'runScript' (server-side automation scripts). Because these actions are executed by the system scheduler, they can provide persistent, recurring execution of administrative commands even if the attacker's session ends or if an administrator attempts to manually revert the changes. The vulnerability is addressed in version 1.3.2 by implementing proper JWT-based administrative permission checks.

Affected products

  • frangoteam FUXA <= 1.1.14-1243

Identifiers

  • CVE-2026-47721
  • GHSA-8ghr-w65f-j3qr

Timeline

  • 2026-05-29: disclosed: Advisory published by vendor
  • 2026-06-08: advisory: GitHub Advisory published
  • 2026-06-08: patched: Fix confirmed in version 1.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.