CVE-2026-25893: FUXA authentication bypass leading to remote code execution
CVE-2026-25893 affects FUXA, a web-based process visualization (SCADA/HMI/dashboard) product, before 1.2.10. According to the record, an unauthenticated remote attacker can reach administrative access through the heartbeat refresh API and execute arbitrary code on the server. The vendor patch is in version 1.2.10.
Overview
FUXA is web-based process visualization software used for SCADA, HMI and dashboard applications. CVE-2026-25893 is an authentication bypass that, according to the record, lets an unauthenticated remote attacker gain administrative access through the heartbeat refresh API and run arbitrary code on the server. The record classifies the weakness as CWE-285 (Improper Authorization).
Impact
- An unauthenticated remote attacker may obtain administrative access, as stated in the record.
- The record describes arbitrary code execution on the server as a result.
- NVD rates the issue 9.8 (critical). The GitHub CNA rates it 10 under a newer CVSS framework.
- In industrial or building automation settings, a compromised server could affect process visualization and connected operations. This is an inference from the product type.
Affected products and versions
- Product: Frangoteam Fuxa.
- Affected: versions before 1.2.10.
- Fixed in: 1.2.10.
- The record provides no additional version granularity.
Exploitation status
The record shows FUXA is not listed in the CISA KEV catalog, and the SSVC data lists exploitation as none. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade FUXA to 1.2.10 or later, which contains the vendor patch referenced below.
- Review the GitHub commit and the GitHub security advisory for vendor guidance.
- Until patched, restrict network exposure of FUXA web interfaces, limit access to trusted networks or VPNs, and avoid direct internet exposure. These are general defensive measures; the record does not describe a specific workaround.
- Inventory every FUXA instance, including those in OT and ICS environments, and prioritize them for patching.
Detection guidance
- Review FUXA access and application logs for administrative actions or sessions from unexpected sources.
- Monitor hosts running FUXA for unexpected process starts or file changes.
- Correlate with network telemetry for unusual traffic to the FUXA web service. The record does not provide specific detection signatures.
Limitations of the available information
- The record does not describe prerequisites, default configuration exposure or detailed technical conditions.
- It does not confirm whether every configuration of every version before 1.2.10 is vulnerable.
- No exploitation evidence or public exploit references are included in the record.
- Scores differ between providers, and the record does not reconcile them.
Frequently asked questions
What is CVE-2026-25893?
It is an authentication bypass in FUXA, a web-based process visualization product. According to the record, it allows an unauthenticated remote attacker to gain administrative access and execute arbitrary code on the server.
Which FUXA versions are affected?
The record lists versions before 1.2.10 as affected, and 1.2.10 as the patched version.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV and SSVC lists exploitation as none. No confirmed exploitation appears in the sources consulted.
What should administrators do?
Upgrade FUXA to 1.2.10 or later, review the vendor commit and advisory, and restrict network exposure of FUXA interfaces until the update is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.