CVE-2026-25939CWE-862

FUXA Unauthenticated Remote Arbitrary Scheduler Write

Critical · published February 9, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10,

an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
EPSS
0.00937 · 60.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-09T22:21Z
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 12% → 1%
    epss
  • 09 FEB 22:21Z
    FUXA Unauthenticated Remote Arbitrary Scheduler Write
    cvelistv5