CVE-2026-25939 CRITICAL

CVE-2026-25939: FUXA Unauthenticated Remote Arbitrary Scheduler Write

Vendor Frangoteam

Product FUXA

Weakness CWE-862 · Missing authorization

Published February 9, 2026

Last update February 11, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

What the vulnerability does

01Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Key dates

02Disclosure timeline

February 9, 2026 CVE published

February 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25939 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-64520 GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API CVE-2023-4282 EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data CVE-2023-44258 WordPress Schema App Structured Data plugin <= 1.23.1 - Broken Access Control + CSRF vulnerability CVE-2024-56067 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability CVE-2025-12391 Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update