CVE-2026-25895

CRITICAL9.8Published on February 9, 2026

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-22, CWE-306

Vendorsfrangoteam

Affected products

Vendors	Prodotto	Versioni
frangoteam	fuxa	< 1.2.10

MLflow e FUXA sotto attacco: sfruttate falle critiche in AI e automazione industriale

Vulnerabilities

MLflow and FUXA Under Attack: Critical AI and Industrial Automation Flaws Exploited

Critical flaws in MLflow and FUXA are being exploited, posing risks to AI and industrial automation. Learn about CVEs and mitigation strategies.

Aug 18, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

MLflow and FUXA Under Attack: Critical AI and Industrial Automation Flaws Exploited