Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.
According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows –
- CVE-2026-64849 (CVSS score: 9.3) – An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow that can allow an attacker who can reach the Tracking Server (mlflow server) to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. (Affects versions < 3.15.0)
- CVE-2026-25895 (CVSS score: 9.5) – A missing authentication for a critical function and path traversal vulnerability in FUXA that can allow an unauthenticated, remote attacker to write arbitrary files to the server file system and achieve remote code execution. (Affects versions <= 1.2.9)
“Attackers are exploiting [CVE-2026-64849] to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets,” watchTowr said in a post on LinkedIn, adding it detected bad actors indiscriminately scanning for exposed MLflow instances online within hours of the CVE being assigned on August 17, 2026.
“It allows an attacker to exploit a flaw in MLflow’s model-registry webhooks to proxy requests through the affected system and interact with internal services,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.
“The security bug bypasses prior fixes because of how it handles web redirects. Evidence from our global honeypot telemetry indicates attackers are abusing this vulnerability to target cloud-hosted MLflow systems in an attempt to extract credentials and secrets from well-known internal IP addresses and services.”
Organizations running MLflow are recommended to prioritize patching affected, exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials have been exposed.
As for CVE-2026-25895, VulnCheck said it detected malicious scanning aimed at the flaw starting August 18, 2026. A single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. There are about 60 FUXA installations exposed to the public internet.
“The attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal,” Caitlin Condon, vice president of research at VulnCheck, said in a LinkedIn post. “No RCE payloads dropped yet.”
Over the past year, two other vulnerabilities in FUXA – CVE-2026-25939 and CVE-2023-33831 – have also witnessed active exploitation efforts, with the latter witnessing activity “dating back to November 2025 and as recently as yesterday,” per Condon.
