Skip to main content
IMMUNITYSEC

CVE-2026-25895

CVE-2026-25895 is a critical-severity vulnerability in frangoteam FUXA (CVSS 4.0 CVSS-B score 9.5), classified as CWE-22 (Path Traversal). It is not in the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment rates its exploitation as none. As of 2026-11-14, EPSS estimates a 12.8% probability of exploitation in the next 30 days, in the 96th percentile of scored CVEs.

Updated

CVSS 4.0
9.5 CRITICAL
EPSS
12.8% (96th pct)
CISA KEV
Not listed
Published
2026-02-09
Weakness
CWE-22, CWE-306

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Key Findings

as of 2026-11-14
All KEV statistics→
  • Its current EPSS score (12.8%) is higher than that of 28% of CISA KEV entries.

Severity

CVSS 4.0 · CNA · CVSS-B9.5 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HOpen in CVSS calculator
SSVC · CISA-ADP
Exploitationnone
Automatableno
Technical impacttotal

Affected Products

ProductAffected versions
frangoteam
FUXA
< 1.2.10

References

3 links

Other references

Record Details

Published
2026-02-09
Last updated
2026-02-11
Assigner (CNA)
GitHub_M
Credited to
-

More from frangoteam

CVE-2026-259399.3 CRITICAL

FUXA Unauthenticated Remote Arbitrary Scheduler Write

frangoteamEPSS 24.3%2026-02-09

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.