Live › vulnerability › CVE-2026-40063
FUXA, a web-based SCADA and HMI tool, exposes its /nodered/fuxa/scripts functionality to unauthenticated HTTP requests. A crafted request can make the server leak information, per the NVD description of version 1.3.2-2809.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:41 UTC. All times on this page are UTC.
FUXA instances reachable over HTTP, most likely industrial or building control deployments where FUXA is used as a SCADA or HMI front end. Instances that are not network-reachable by untrusted parties are lower exposure. The sources do not say whether authentication settings change the outcome beyond the unauthenticated request described.
No product ranges from the sources yet.
1.3.2-2809.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-40063")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.