CVE-2026-25893

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.2.10

Description FUXA is a web-based Process Visualization software. A flaw exists where an unauthenticated, remote attacker can gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This is possible when the runtime.settings.secureEnabled setting is set to true. Exploitation involves minting administrator JWTs through the heartbeat refresh endpoint, allowing interaction with administrative APIs and potential full system compromise, which could impact connected ICS/SCADA environments. The API endpoint involved is the heartbeat refresh API.

Recommendations Update to FUXA version 1.2.10 or later.