CVE-2026-47721 frangoteam CVE debrief

Who should care

Operators and administrators of FUXA systems should assess their exposure and verify access controls to prevent unauthorized changes. This includes reviewing system logs, verifying access controls, and considering compensating controls for exposed systems. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take steps to mitigate them.

Why it matters

CVE-2026-47721 allows an authenticated non-admin operator to create or alter device actions and delete schedules in FUXA, gaining access to sensitive functionality normally restricted to administrators. This issue requires verification of access controls and prompt remediation to prevent unauthorized changes.

• An authenticated non-admin operator can gain access to device-value changes normally reserved for administrators.
• An authenticated non-admin operator can gain access to server-side project script execution normally reserved for administrators.
• Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends.

Technical summary

FUXA, a web-based Process Visualization software, has a vulnerability in versions prior to 1.3.2. The POST /api/scheduler and DELETE /api/scheduler endpoints in server/api/scheduler/index.js do not consistently enforce authentication and authorization for scheduler settings, allowing an authenticated non-admin operator to create or alter device actions and delete schedules. This issue requires verification of access controls and prompt remediation to prevent unauthorized changes. The vulnerability can lead to unauthorized access to device-value changes and server-side project script execution normally reserved for administrators.

Defensive priority

Operators and administrators of FUXA systems should verify and restrict access to scheduler settings to prevent unauthorized changes.

Recommended defensive actions

• Verify and restrict access to scheduler settings in FUXA systems.
• Update FUXA to version 1.3.2 or later.
• Monitor system logs for unauthorized changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions requires verification. The FUXA software is used for Process Visualization and SCADA/HMI/Dashboard applications. The vulnerability allows an authenticated non-admin operator to create or alter device actions and delete schedules, potentially leading to unauthorized changes in device-value changes and server-side project script execution. Defenders should verify access controls, review system logs, and consider compensating

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.