HIGH

CVE-2026-47717

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

CVSS v3

7.5

HIGH

EPSS Score

—

exploit probability

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

Technical details

CVSS v3 Vector
3.1
Published
8/12/2026
Last Modified
8/12/2026

Frequently asked questions

What is CVE-2026-47717?

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

Is CVE-2026-47717 actively exploited?

Active exploitation of CVE-2026-47717 has not been confirmed. The EPSS score is N/A%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-47717?

CVE-2026-47717 has a CVSS v3 base score of 7.5 (HIGH severity), with vector string 3.1.

Is CVE-2026-47717 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEs

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database