CVE-2026-25895

FUXA is a dashboard-style system used to visualize and monitor industrial or operational processes. This vulnerability is like leaving a “upload” door unlocked: a remote attacker can drop crafted files onto your server without logging in. If they place the right kind of file, it can turn into full control of your server and disrupt your operations.

This matters if you run FUXA (or fuxa-server) for process visualization/monitoring in your business or on behalf of customers. The vulnerability is reachable without authentication and works through the Upload API, so exposure depends on whether that FUXA web service is reachable by an attacker (for example, exposed to the internet) and whether the vulnerable version (through 1.2.9) is deployed.

This is RED because the vulnerability is unauthenticated and remote, and it has been gaining exploitation attention. Attackers can use it to write arbitrary files and achieve remote code execution, so waiting increases the chance of compromise.

1. Confirm exposure and versions

   • Identify whether you run FUXA and/or fuxa-server.
   • Determine the installed version; this issue affects FUXA through version 1.2.9.
   • Confirm whether the FUXA web service (including the Upload API) is reachable from untrusted networks (internet, partner networks, or any network attackers can access).

2. Upgrade to the fixed version

   • Fixed in: fuxa-server 1.2.10 and fuxa 1.2.10.
   • Upgrade both components if both are deployed in your environment.

3. Post-upgrade validation

   • Ensure FUXA is functioning normally and that the upload workflow still works.
   • Review server logs around the upgrade window and prior to it for suspicious upload requests or unusual file-writing behavior.

4. Temporary risk reduction while patching (if you cannot upgrade immediately)

   • Restrict network access to the FUXA web service so it is not reachable from the public internet.
   • Limit access to trusted IP addresses/VPN only.
   • If you have a load balancer or reverse proxy, apply strict access controls to the endpoints involved in uploads.

5. What to monitor

   • Log entries indicating upload attempts from unknown sources.
   • Any signs of unexpected new files, new scheduled tasks/processes, or abnormal outbound connections from the server.

6. KEV note

   • This CVE is not listed in the CISA KEV feed per the provided findings.

Severity is critical with a high likelihood of full impact: remote, unauthenticated, and involving arbitrary file write (CWE-22, CWE-306) that can lead to remote code execution. The vulnerable component is the Upload API; attackers can craft upload requests to cause files to be written to chosen locations on the server filesystem. Patching is available in fuxa-server 1.2.10 and fuxa 1.2.10.

Exploitation status: KEV is not listed, but press attention is rising and exploitation is being discussed; weaponization is present as a detection template (indicating active targeting/testing in the ecosystem), and this is treated as a confirmed RED priority for remediation in this tracker. Predicted likelihood is listed as 10.4% with a rising trend, but since KEV is not confirmed, exploitation-likelihood numbers are not used as the basis for urgency here.