CVE-2026-25939 is a critical authorization bypass (CVSS 9.1) in FUXA, the web based SCADA and HMI software. An unauthenticated remote attacker can create and modify arbitrary schedulers, exposing connected ICS environments to follow-on actions. Upgrade to FUXA 1.2.11. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- FUXA 1.2.8 through 1.2.10
- Fixed in FUXA 1.2.11
The 1.2.11 release notes say guest users can no longer modify scheduler settings. The record lists no workaround. A separate FUXA advisory covers a later scheduler authorization issue, so keep the product on its current release.
How to check if you're exposed
Identify each FUXA installation and its version. Then ask whether the scheduler feature is in use and whether the server can be reached by untrusted users. A scheduler that fires device actions at set times is a place where a malicious entry could do harm quietly.
Review existing schedulers for entries nobody on your team created.
What to do now
- Upgrade FUXA to 1.2.11 or later, and preferably to the current release.
- Review every scheduler and remove any you do not recognize.
- Keep FUXA off the internet and behind a firewall or VPN.
- Limit who can reach the interface to named operators on the plant network.
- Log scheduler changes and review them on a regular schedule.
Why it matters
CWE-862 is missing authorization. Authentication asks who you are. Authorization asks what you may do. Here the application did not enforce the second question on scheduler functions, so the identity of the caller, even an anonymous one, was not checked against permission.
Schedulers matter because they turn a one off change into repeated action. A tampered schedule can sit unnoticed until it runs, which is why the record describes follow-on actions against connected systems.
The score is 9.1, a little lower than its sibling CVE-2026-25938, because the vector shows no confidentiality impact.
Quick check
How is this different from the Node-RED issue?
That one needs the Node-RED plugin and ends in code execution. This one is about creating and changing schedulers without permission. Both are fixed in 1.2.11.
What should I check after upgrading?
Look at the scheduler list for entries you did not create.
Sources
Last reviewed: 19 October 2026.
