9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25939

CVE-2026-25939: FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25939

CVE-2026-25939:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	>= 1.2.8, < 1.2.11	1.2.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-c869-jx4c-q5fc, is an authorization bypass in FUXA's scheduler functionality. The analysis of the patch commit aced6ad0b6089eea4e5cef51c0a88bf4f308d45f reveals that the core issue was missing authorization checks in the API endpoints responsible for managing schedulers.

The vulnerability allowed an unauthenticated attacker to obtain a 'guest' session token and then use this token to perform privileged actions. The patch addresses this by introducing a new helper function, isGuestUser, in server/api/jwt-helper.js to identify guest users.

This helper is then used in server/api/scheduler/index.js to add explicit authorization checks to the POST and DELETE handlers for the /api/scheduler route. Before the patch, these handlers would process requests without verifying if the user was a guest, thus allowing unauthorized creation, modification, and deletion of schedulers. The patch ensures that if security is enabled, any attempt by a guest user to access these endpoints results in a 401 Unauthorized error. The vulnerable functions are the Express.js route handlers for POST /api/scheduler and DELETE /api/scheduler.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.