High severity · published Jul 21, 2026
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
8.9
CVSS
0.8%
EPSS
No
On KEV
Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
FUXA · frangoteam
>= 1.2.11, < 1.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43945
github.com
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1
github.com
https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj
More from FUXA
9.8
CVE-2025-69985
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE)
9.8
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
9.8
CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
9.8
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
9.8
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration