- Two critical vulnerabilities in MLflow (CVE-2026-64849, CVSS 9.3) and FUXA (CVE-2026-25895, CVSS 9.5) are under active exploitation.
- Attackers are exploiting the MLflow flaw to reach cloud metadata services and exfiltrate credentials and secrets.
- The FUXA vulnerability allows unauthenticated remote code execution and path traversal, with broad scanning detected.
WatchTowr and VulnCheck report that malicious actors are actively scanning and exploiting two severe vulnerabilities in open-source platforms MLflow and FUXA, risking cloud credentials and operational technology systems. The first flaw, CVE-2026-64849 (CVSS 9.3), is an unauthenticated Server-Side Request Forgery (SSRF) in MLflow that allows attackers to issue HTTP requests to arbitrary internal cloud metadata endpoints. WatchTowr stated that “attackers are exploiting… to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets” within hours of the CVE being assigned on August 17, 2026.
The security bug bypasses prior fixes through mishandled web redirects in MLflow’s model-registry webhooks, according to watchTowr’s Yordan Ganchev. Organizations running MLflow should prioritize patching, review audit logs for compromise, and check for exposed sensitive credentials. The second vulnerability, CVE-2026-25895 (CVSS 9.5), affects FUXA, a web-based SCADA/HMI software, and enables unauthenticated path traversal leading to remote code execution.
VulnCheck detected malicious scanning for this flaw beginning August 18, 2026, with a single IP address broadly scanning the internet for vulnerable FUXA instances, of which about 60 are publicly exposed. Caitlin Condon of VulnCheck noted that the attacker request attempts to overwrite main.js via path traversal, though no RCE payloads have been dropped yet. Meanwhile, two older FUXA vulnerabilities, CVE-2026-25939 and CVE-2023-33831, have also seen active exploitation dating back to November 2025.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
