CVE-2026-25893CWE-285CWE-287

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

Critical · published February 9, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01208 · 68.1th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-287 · Improper Authentication
Published
2026-02-09T22:26Z
EPSS history
Timeline
  • 09 FEB 22:26Z
    FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
    cvelistv5