MLflow and FUXA Under Attack: Critical AI and Industrial Automation Flaws Exploited

Active Scanning Targets MLflow Servers and FUXA Installations

Scanning and exploitation attempts are currently targeting exposed MLflow deployments—the open-source platform for managing machine learning workflows—and FUXA, a web-based SCADA/HMI platform used in OT and industrial environments.

The activity was observed by watchTowr and VulnCheck. For MLflow, scanning began within hours of the assignment of CVE-2026-64849 on August 17, 2026. For FUXA, VulnCheck detected malicious activity on August 18, 2026, including an IP address systematically searching for installations accessible from the Internet.

Current estimates indicate approximately 60 publicly exposed FUXA installations. Observed requests attempted to overwrite main.js by exploiting CVE-2026-25895. No code-execution payloads have been deposited through this activity so far, but the technique could facilitate a full server compromise.

The two platforms present different risk profiles. MLflow can provide access to cloud credentials and internal services, while FUXA can expose automation systems, ICS equipment, and industrial processes directly.

MLflow: SSRF Enables Access to Internal Services and Cloud Metadata

CVE-2026-64849 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. It affects the Model Registry webhook delivery system and can be exploited by anyone able to reach the MLflow Tracking Server.

The affected endpoint is:

POST /api/2.0/mlflow/webhooks/{id}/test

An attacker can cause the server to send HTTP requests to loopback addresses, internal hosts, administrative interfaces, and cloud infrastructure metadata services. The upstream response is then returned by the test endpoint, including the HTTP status and response body.

This is therefore not a “blind” SSRF. An attacker can directly read whatever the server is able to access, including IAM tokens, temporary credentials, and other secrets exposed by cloud services. The archive lists a CVSS score of 9.3, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

The issue results from the interaction of several flaws in destination handling. The _validate_webhook_url function, introduced in version 3.10.0, resolves the hostname and blocks private, loopback, link-local, and metadata-service addresses. However, the validated address is not bound to the subsequent connection.

The server also follows redirects because the HTTP session does not set allow_redirects=False. Redirect destinations are not validated again, enabling DNS rebinding scenarios in which the hostname resolves to a public address during validation but to an internal resource when the connection is made.

For example, a public HTTPS endpoint could respond with a 302 redirect to:

http://169.254.169.254/latest/meta-data/iam/security-credentials/

307 and 308 redirects are also possible. Because they preserve the request method and body, they may enable variants involving writes to internal destinations.

The vulnerability was confirmed on mlflow==3.13.0 with the default SQLite database. Authentication is not required: webhooks are unprotected in the standard server configuration, while authorization checks are available only through an optional plugin that is not loaded by default.

Version guidance is not fully consistent. One operational threshold identifies versions before 3.15.0 as vulnerable, while the technical advisory confirms impact on 3.13.0 and earlier without listing a fixed version in the record. The fix is associated with pull request #24258 and commit ba94952247, which introduces SSRFProtectedHTTPAdapter.

The new adapter checks the socket IP immediately after connection and before the TLS/HTTP exchange. Redirects also pass through the protected mechanism, preventing bypasses through redirection and DNS rebinding.

FUXA: Arbitrary File Writes and Potential Code Execution

CVE-2026-25895 affects FUXA through version 1.2.9. The issue is fixed in version 1.2.10.

The vulnerability combines path traversal with a lack of authentication on a critical function. An unauthenticated remote attacker can write arbitrary files to attacker-controlled paths on the server filesystem, even when runtime.settings.secureEnabled is set to true.

Potential impact includes overwriting application files, configuration files, and startup scripts. If a modified file is later loaded or executed, the write primitive can lead to remote code execution. Severity depends on the privileges of the FUXA process and its connections to OT networks and SCADA systems.

The advisory assigns a CVSS 4.0 score of 9.5, indicating high impact on the confidentiality, integrity, and availability of the vulnerable system and downstream systems. The archive also reports a CVSS 3.1 score of 9.8:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

During the observed scanning activity, attackers attempted to overwrite main.js with meaningless data. The absence of an RCE payload at this stage does not reduce the priority of the issue; it shows that attackers are already reaching the vulnerable function and testing its behavior.

This issue is separate from CVE-2025-69981, which was linked to an insecure upload function. That functionality had been protected by authentication; the current vulnerability is instead a path traversal flaw allowing arbitrary file writes.

FUXA: Authorization Bypass Affecting Industrial Schedulers

FUXA also contains CVE-2026-25939, an authorization bypass classified as CWE-862. Affected versions are before 1.2.11; the listed fix is FUXA 1.2.11.

The flaw allows an unauthenticated remote user to create or modify arbitrary schedulers. In versions 1.2.8 through 1.2.10, this capability can be used to prepare follow-on actions against connected ICS and SCADA environments.

The vulnerability has a CVSS score of 9.1:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

The primary impact concerns integrity and availability: a modified scheduler can alter expected plant behavior or trigger unauthorized operations. No further technical indicators are available for the observed attempts against this vulnerability.

The activity targeting FUXA is part of a broader campaign. Exploitation of CVE-2023-33831, rated CVSS 9.8, has also been observed with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

According to available information, this activity began in November 2025 and continued until shortly before detection. No additional details about the attack vector or indicators are currently known.

What to Check and How to Reduce Exposure

Administrators should upgrade FUXA to at least 1.2.10 for CVE-2026-25895 and 1.2.11 for CVE-2026-25939. For MLflow, apply the fix associated with PR #24258; the operational upgrade threshold is 3.15.0, while the available technical confirmation covers version 3.13.0.

Whenever possible, MLflow and FUXA should not be directly exposed to the Internet. Access should be restricted through network segmentation, strong authentication, and firewall rules preventing the server from freely reaching internal services.

For MLflow, review logs for:

• webhook creation and modification;
• requests to /api/2.0/mlflow/webhooks;
• use of the /test endpoint;
• redirects originating from public HTTPS hosts;
• requests to 169.254.169.254, 127.0.0.1, and RFC 1918 addresses.

Also check for access to IAM tokens, cloud credentials, application secrets, and administrative services. Any potentially exposed credentials should be revoked and replaced.

On FUXA, look for traversal requests, unexpected changes to main.js, anomalous filesystem writes, and unauthorized scheduler modifications. Connected systems should be checked for altered files, newly created scheduled tasks, and unexpected commands or process changes.

These vulnerabilities are not currently listed in the CISA KEV catalog, and no CISA remediation deadline has been assigned. As a result, there is currently no specific KEV deadline.