Web-Based Process Visualization Software Vulnerability in FUXA by Frango Team
CVE-2026-65985

6MEDIUM

Key Information:

Vendor

Frangoteam

Status
Fuxa
Vendor
CVE Published:
18 August 2026

What is CVE-2026-65985?

FUXA, a web-based Process Visualization software, contains a vulnerability that allows authenticated non-admin runtime users to manipulate the server's outbound HTTP or HTTPS requests. This security flaw arises from the improper handling of requests in the device-webapi-request Socket.IO handler, permitting potential attackers to exploit the FUXA server as an SSRF oracle. Depending on the network deployment of the FUXA host, individuals could gain unauthorized access to internal services or cloud metadata endpoints. The issue has been resolved in version 1.3.3, highlighting the importance of keeping software up to date to mitigate potential threats.

Affected Version(s)

FUXA < 1.3.3

References

https://github.com/frangoteam/FUXA/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2379
x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed...
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.