Critical MLflow and FUXA flaws exploited in wild

WatchTowr and VulnCheck report that malicious actors are actively scanning and exploiting two severe vulnerabilities in open-source platforms MLflow and FUXA, risking cloud credentials and operational technology systems. The first flaw, CVE-2026-64849 (CVSS 9.3), is an unauthenticated Server-Side Request Forgery (SSRF) in MLflow that allows attackers to issue HTTP requests to arbitrary internal cloud metadata endpoints. WatchTowr stated that “attackers are exploiting… to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets” within hours of the CVE being assigned on August 17, 2026.

The security bug bypasses prior fixes through mishandled web redirects in MLflow’s model-registry webhooks, according to watchTowr’s Yordan Ganchev. Organizations running MLflow should prioritize patching, review audit logs for compromise, and check for exposed sensitive credentials. The second vulnerability, CVE-2026-25895 (CVSS 9.5), affects FUXA, a web-based SCADA/HMI software, and enables unauthenticated path traversal leading to remote code execution.

VulnCheck detected malicious scanning for this flaw beginning August 18, 2026, with a single IP address broadly scanning the internet for vulnerable FUXA instances, of which about 60 are publicly exposed. Caitlin Condon of VulnCheck noted that the attacker request attempts to overwrite main.js via path traversal, though no RCE payloads have been dropped yet. Meanwhile, two older FUXA vulnerabilities, CVE-2026-25939 and CVE-2023-33831, have also seen active exploitation dating back to November 2025.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• SpaceX Stock Surges 16% as Musk Predicts Massive Space Economy
• SEC proposes $5M-$75M crypto fundraising exemptions
• Citi to Launch Bitcoin Custody for Institutional Clients Later This Year
• Skepticism Grows Over Tesla Cybercab Safety Claims
• Aave Loses 43% of Assets Since April KelpDAO Hack