CVE-2026-25939
CRITICAL EXPLOITEDFUXA 1.2.8-1.2.10 - Unauthenticated Authorization Bypass via Scheduler Modification
Title source: llmExploitation Summary
CVE-2026-25939 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including XiaomingX, mbanyamer.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2026-25939, an unauthenticated remote arbitrary scheduler write vulnerability in FUXA versions 1.2.8 to 1.2.10. The exploit demonstrates creating, verifying, and deleting schedulers via the /api/scheduler endpoint without authentication.
Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
Exploits (2)
This repository contains a functional Python exploit for CVE-2026-25939, an unauthenticated remote arbitrary scheduler write vulnerability in FUXA versions 1.2.8 to 1.2.10. The exploit demonstrates creating, verifying, and deleting schedulers via the /api/scheduler endpoint without authentication.
This is a functional exploit PoC for CVE-2026-25939, targeting an authentication bypass in FUXA's scheduler API. It demonstrates unauthenticated creation, modification, and deletion of schedulers, which can lead to remote code execution in SCADA/ICS environments.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H