CVE-2026-25938: FUXA Authentication Bypass Leading to Remote Code Execution via Node-RED Plugin

Overview

FUXA is a web-based process visualization application used for SCADA, HMI and dashboard purposes. According to the record, an authentication bypass in FUXA, classified as CWE-290 (Authentication Bypass by Spoofing), can be exploited remotely without credentials when the Node-RED plugin is enabled. The vendor advisory and the patch commit are referenced in the record.

Impact

The record describes the potential result as arbitrary code execution on the server.
The NVD base score is 9.8 (critical). GitHub's CNA record assigns 9.5 under its own scoring method.
The NVD scoring metrics describe network access, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
SSVC data in the record marks the technical impact as total and the vulnerability as automatable.

Affected products and versions

Product: Frangoteam Fuxa.
Affected range: from 1.2.8 up to, but not including, 1.2.11.
Exposure depends on the Node-RED plugin being enabled. Installations without that plugin are described as not affected by this specific condition in the record, which only states the plugin as a precondition.

Exploitation status

The record shows CISA KEV status as not listed. This report therefore does not state active exploitation.
No confirmed exploitation in the wild appears in the sources consulted.
EPSS data in the record gives a probability of 0.01483 and a percentile of 0.73781.
SSVC exploitation is recorded as none.

Remediation and mitigation

Upgrade FUXA to version 1.2.11 or later, which the release notes and the patch commit are linked to.
If an immediate upgrade is not possible, review whether the Node-RED plugin is required and disable it where it is not needed, as a temporary risk reduction measure.
Restrict network access to the FUXA interface to trusted networks and management segments, and avoid direct exposure to the internet.
Review the official advisory for any additional vendor guidance before deployment.

Detection guidance

Inventory all FUXA instances and record their version and whether the Node-RED plugin is enabled.
Review access logs for unexpected requests to administrative or plugin-related functions from unknown sources.
Monitor the host running FUXA for unexpected child processes or changes to configuration files, as signs of post-compromise activity.
Treat any unexplained process activity on a FUXA server as a potential incident and follow your internal response process.

Limitations of the available information

The record does not provide proof-of-concept details, and this report does not describe attack steps.
Public exploit availability is not stated in the record and is unknown here.
The record gives an EPSS date of 2026-10-23, which should be checked against the current source before use in prioritization.
Whether earlier versions outside the stated range are affected is not stated in the record.

Frequently asked questions

Which FUXA versions are affected by CVE-2026-25938?

According to the record, FUXA versions from 1.2.8 up to, but not including, 1.2.11 are affected.

Is the vulnerability exploited in the wild?

The record shows the vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Does the issue apply if the Node-RED plugin is disabled?

The record names the Node-RED plugin being enabled as the condition for the remote code execution impact. Installations without it are not described as affected by this condition.

What is the recommended remediation?

Upgrade FUXA to version 1.2.11 or later. If that is not immediately possible, review whether the Node-RED plugin is needed and restrict network access to the FUXA interface.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.