CVE-2026-25895

CVE Enrichment

CVSS: 9.5 CRITICAL
EPSS: 6.92%
EPSS Percentile: 93.96%
CISA KEV: Not listed

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: security-advisories@github.com
Published: 10-Feb-2026 06:16
Last Modified: 17-Jun-2026 17:25
EPSS Date: 2026-10-12
CWE: CWE-22, CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

frangoteam / fuxa
Version / affected range: * · before (exclusive) 1.2.10
cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 21:54
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-25895 Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited

CVE (71)

Malware (4)

Threat Actors (1)

Vendors (22)

Products (18)

Tools (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.