{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fuxa-1.3.2-2809/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frangoteam:fuxa:1.3.2-2809:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-42922"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FUXA (1.3.2-2809)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FUXA"],"content_html":"\u003cp\u003eCVE-2026-42922 describes a critical vulnerability in FUXA version 1.3.2-2809. The flaw resides in the /nodered functionality, where missing authorization controls allow an unauthenticated attacker to submit crafted HTTP requests, resulting in arbitrary code execution. No vendor patch information or remediation details were provided at the time of the NVD disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution on the server hosting the FUXA application, which can lead to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of FUXA 1.3.2-2809 within the environment.\u003c/li\u003e\n\u003cli\u003eImplement strict network access controls to restrict access to the /nodered endpoint to trusted management IP addresses only.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous requests directed at the /nodered path.\u003c/li\u003e\n\u003cli\u003ePrioritize the deployment of updates as soon as the vendor releases a patched version.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T05:03:09Z","date_published":"2026-10-29T05:03:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce/","summary":"An authorization bypass vulnerability in the /nodered endpoint of FUXA 1.3.2-2809 allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests.","title":"FUXA: Authorization bypass and remote code execution (CVE-2026-42922)","url":"https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - FUXA (1.3.2-2809)","version":"https://jsonfeed.org/version/1.1"}