Loading story…
A critical vulnerability tracked as CVE-2026-25895 affects FUXA versions <= 1.2.9, allowing an unauthenticated attacker to exploit a path traversal flaw and gain an arbitrary file-write primitive. Public reporting and a related detection template describe the issue as impacting the FUXA SCADA/OT management dashboard, where successful exploitation can let a remote attacker overwrite files without authentication.
VulnCheck reported active malicious scanning for exposed FUXA systems, observing a single IP broadly probing internet-facing instances and attempting to overwrite main.js with junk data. Researchers said the same file-write capability was sufficient in testing to drop a root shell, underscoring the risk of full compromise on vulnerable OT deployments; VulnCheck also estimated roughly 60 FUXA instances were publicly exposed and noted prior exploitation involving other FUXA vulnerabilities, including CVE-2026-25939 and CVE-2023-33831.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request documented CVE-2026-25895 as affecting FUXA versions up to and including 1.2.9 and described it as an unauthenticated path traversal leading to arbitrary file write. On August 18, 2026, the PR workflow showed self-assignment, automated labeling, reviewer request, and assignment activity.
VulnCheck made an exploit, PCAP, Suricata rules, Snort rules, and a target Docker container for CVE-2026-25895 available to Initial Access Intelligence customers on July 25, 2026. The materials supported detection and testing of the FUXA path traversal issue.
On July 25, 2026, VulnCheck's Canary network observed malicious scanning from a single IP for vulnerable FUXA instances exploiting CVE-2026-25895. The requests attempted to overwrite main.js with junk data via the path traversal file-write primitive, though VulnCheck had not yet seen RCE payloads dropped in this activity.
VulnCheck reported that exploitation activity targeting FUXA vulnerability CVE-2023-33831 dates back to November 2025. The flaw was described as a remote command execution vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Pandora FMS disclosed two high-severity vulnerabilities affecting versions `777` through `800`, including **CVE-2026-30804**, an unrestricted file upload flaw in the Extension Uploader that can allow remote code execution, and **CVE-2026-30811**, a missing authorization issue in a configuration AJAX endpoint that can expose sensitive information. The file upload bug is classified as `CWE-434`, indicating that attackers may be able to upload dangerous file types and execute code on vulnerable systems. The second flaw, mapped to `CWE-276`, stems from improper authorization controls and could let unauthorized users access configuration data through the affected endpoint. Both CVE records were published with CVSS v4.0 vectors and vendor references from Pandora FMS, indicating that the issues were formally acknowledged by the vendor and impact the same product range.
Jun 29, 2026
Public advisories disclosed two **root-level remote code execution** vulnerabilities in **atvise SCADA 3.13.0** from atvise GmbH / Bachmann Visutec, affecting deployments with the `WEBACCESS` module enabled. One flaw allows **pre-authentication** compromise through an **OPC UA authentication bypass** on port `4840`, which can be chained with WebMI script tampering and anonymous request paths to execute arbitrary commands as `root`. The second issue is an **authenticated default-credential RCE** in WebHMI/WebMI, where a built-in `root` account ships with an empty password and a login branch can grant a superuser session without proper password verification while that default state remains. Researchers said successful exploitation can lead to **complete host compromise**, including arbitrary command execution, file access, and manipulation of SCADA control logic and node values. The advisory noted that `WEBACCESS` is normally loaded in licensed production deployments, increasing practical exposure, and said **proof-of-concept code** and full technical analysis were released publicly through Full Disclosure and separate write-ups covering the OPC UA unauthenticated attack path and the WebMI default-credential RCE.
Aug 6, 2026