CVE-2026-25895
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Early warning: exploitation observed
- Exploitation observed since Aug 18, 2026
- Not yet in the official CISA catalogue
- First attack observed 189 days after disclosure
- Confirmed by sensors, not only by reports
Source: VulnCheck KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-22, CWE-306
Vendorsfrangoteam
Affected products
| Vendors | Product | Versions |
|---|---|---|
| frangoteam | fuxa | < 1.2.10 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.