Is CVE-2026-65985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65985 being exploited in the wild.

How severe is CVE-2026-65985?

Informational severity, published 18 August 2026.

Is there a fix for CVE-2026-65985?

A patch was published on 2026-05-25: Fix merged in version 1.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65985 attacked?

It is attacked over the network.

Am I affected by CVE-2026-65985?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65985: FUXA SSRF vulnerability in device-webapi-request Socket.IO handler

CVE-2026-65985 · Severity: info · Published 2026-08-18

FUXA is a web-based process visualization and SCADA dashboard software used to monitor and control industrial systems. A flaw in versions 1.3.2 and earlier allows an authenticated user with non-admin runtime access to exploit a server-side request forgery (SSRF) vulnerability, potentially enabling the attacker to read responses from internal services or cloud metadata endpoints that the FUXA server can reach. This could expose sensitive internal configuration, credentials, or infrastructure details depending on the deployment environment.

Quick answers

Is CVE-2026-65985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65985 being exploited in the wild.
How severe is CVE-2026-65985?: Informational severity, published 18 August 2026.
Which products and versions are affected?: FUXA FUXA 1.3.2 and earlier.
Is there a fix for CVE-2026-65985?: A patch was published on 2026-05-25: Fix merged in version 1.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65985 attacked?: It is attacked over the network.
Am I affected by CVE-2026-65985?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the device-webapi-request Socket.IO handler located in server/runtime/index.js. An authenticated non-admin runtime user can manipulate the property.address parameter to cause the FUXA server to issue arbitrary outbound HTTP or HTTPS requests and return the response body to the attacker. The attack requires authentication (user login) and network access to the Socket.IO interface, but does not require admin privileges. An attacker can use this to read responses from internal services (databases, cloud metadata endpoints like AWS EC2 IMDSv1, internal APIs) that are reachable from the FUXA host. The vulnerability is patched in version 1.3.3.

Affected products

FUXA FUXA 1.3.2 and earlier

Timeline

2026-08-18: disclosed
2026-05-25: patched: Fix merged in version 1.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.