How severe is CVE-2026-25939?

CVE-2026-25939 has a CVSS 4.0 CVSS-B score of 9.3 (CRITICAL). EPSS estimates a 24.3% probability of exploitation in the next 30 days.

CVE-2026-25939

CVE-2026-25939 is a critical-severity vulnerability in frangoteam FUXA (CVSS 4.0 CVSS-B score 9.3), classified as CWE-862 (Missing Authorization). It is not in the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment rates its exploitation as none. As of 2026-11-14, EPSS estimates a 24.3% probability of exploitation in the next 30 days, in the 97th percentile of scored CVEs.

Updated 2026-02-11

CVSS 4.0: 9.3 CRITICAL
EPSS: 24.3% (97th pct)
CISA KEV: Not listed
Published: 2026-02-09
Weakness: CWE-862

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

Key Findings

as of 2026-11-14

All KEV statistics→

Its current EPSS score (24.3%) is higher than that of 36% of CISA KEV entries.

Severity

CVSS 4.0 · CNA · CVSS-B9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:HOpen in CVSS calculator

SSVC · CISA-ADP

Exploitationnone

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
frangoteam	frangoteam FUXA	< 1.2.11

References

3 links

Other references

Record Details

Published: 2026-02-09
Last updated: 2026-02-11
Assigner (CNA): GitHub_M
Credited to: -

More from frangoteam

CVE-2026-258959.5 CRITICAL

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

frangoteamEPSS 12.8%2026-02-09

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.