CVE-2026-25939: FUXA Unauthenticated Remote Arbitrary Scheduler Write Vulnerability
Summary
CVE-2026-25939: FUXA Unauthenticated Remote Arbitrary Scheduler Write. Affects fuxa-server versions >= 1.2.8, < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is a software package designed for managing and scheduling tasks in industrial control systems (ICS) and supervisory control and data acquisition (SCADA) environments. It provides users with the ability to create, modify, and manage schedules for various connected devices. However, certain versions of FUXA are vulnerable to an authorization bypass issue, which can be exploited by attackers to manipulate these schedules without proper authentication.
Vulnerability Detail
The vulnerability arises from an authorization bypass in FUXA versions 1.2.8 through 1.2.10, allowing unauthenticated remote attackers to create, modify, or delete arbitrary schedulers. This exploitation can lead to unauthorized control over connected devices, enabling attackers to force devices into specific states or execute scripts on the server. The vulnerability is particularly severe as it affects all deployments, even those with secure settings enabled, posing a critical risk to ICS/SCADA environments.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.11
This is the first release that contains the fix.
npm install fuxa-server@1.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the latest version of FUXA.
Conclusion
The FUXA Unauthenticated Remote Arbitrary Scheduler Write vulnerability (CVE-2026-25939) poses a significant risk to users of affected versions. It is essential to update to version 1.2.11 or later to safeguard against potential exploitation. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for fuxa-server →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
FUXA versions 1.2.8 through 1.2.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor your systems closely and limit access to the FUXA application until the update can be applied.
Exploitation of this vulnerability can lead to unauthorized control over connected devices, potentially resulting in operational disruptions or security breaches in ICS/SCADA environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
