CVE-2026-25894 CRITICAL

CVE-2026-25894: FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Vendor Frangoteam

Product FUXA

Weakness CWE-321

Published February 9, 2026

Last update February 11, 2026

View on NVD All CVEs

CVSS base score

9.5/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

Key dates

02Disclosure timeline

February 9, 2026 CVE published

February 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25894 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/321.html