Critical severity · published Feb 9, 2026
CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
FUXA · frangoteam
< 1.2.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25894
Patch
https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d
Release Notes
https://github.com/frangoteam/FUXA/releases/tag/v1.2.10
Vendor Advisory
https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg
More from FUXA
9.8
CVE-2025-69985
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE)
9.8
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
9.8
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
9.8
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
9.8
CVE-2025-69981
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint