CVE-2026-65985 frangoteam CVE debrief

Who should care

Defenders responsible for FUXA deployments, especially those exposed to untrusted users, should assess their exposure and prioritize patching and monitoring. They should also review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-65985 is a medium-severity vulnerability in FUXA that allows an authenticated non-admin user to control property.address, potentially leading to SSRF attacks and read access to sensitive information. Defenders should prioritize patching and monitoring FUXA deployments.

• Potential SSRF attacks against internal services or cloud metadata endpoints
• Read access to sensitive information from internal services or cloud metadata
• Possible use of FUXA server as an oracle for SSRF attacks
• Verification of FUXA deployment network exposure and potential impact

Technical summary

The device-webapi-request Socket.IO handler in FUXA server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. This allows the attacker to use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, potentially leading to SSRF attacks and read access to sensitive information. The vulnerability has a medium severity and is fixed in version 1.3.3.

Defensive priority

Defenders should prioritize verifying and patching FUXA installations, especially those exposed to untrusted users, and monitor for potential SSRF attacks.

Recommended defensive actions

• Verify and patch FUXA installations to version 1.3.3 or later
• Monitor FUXA server logs for suspicious outbound requests
• Restrict access to FUXA runtime users and enforce least privilege
• Implement additional security measures to detect and prevent SSRF attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected deployments and potential impact on cloud metadata endpoints require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.