Critical MLflow and FUXA Vulnerabilities Targeted in Active Attacks
Security researchers have detected malicious scanning and exploitation attempts targeting two critical vulnerabilities affecting MLflow, an open source AI platform, and FUXA, an open source SCADA and HMI platform used in industrial automation environments.
Independent threat intelligence reports from watchTowr and VulnCheck indicate that attackers are actively searching for vulnerable systems exposed to the internet.
MLflow Vulnerability Used to Steal Cloud Credentials
The first vulnerability is CVE-2026-64849, which carries a CVSS score of 9.3.
The flaw is an unauthenticated Server Side Request Forgery vulnerability affecting MLflow versions earlier than 3.15.0.
An attacker who can reach an exposed MLflow Tracking Server can abuse the vulnerability to send HTTP requests to internal services, including cloud metadata endpoints.
This can potentially allow attackers to retrieve sensitive cloud credentials, tokens and other secrets stored within internal cloud infrastructure.
Attackers Scanning Exposed MLflow Servers
watchTowr said it observed attackers scanning the internet for exposed MLflow instances within hours after the vulnerability received its CVE identifier on August 17, 2026.
The vulnerability is related to MLflow model registry webhooks and how the application handles HTTP redirects.
According to watchTowr, attackers are attempting to use compromised MLflow servers as a proxy to access internal services and cloud metadata endpoints.
Global honeypot telemetry indicates that threat actors are targeting cloud hosted MLflow systems and attempting to retrieve credentials and secrets from commonly used internal IP addresses and services.
Organizations running affected MLflow versions should upgrade to 3.15.0 or later and investigate logs for suspicious requests to internal services.
FUXA Vulnerability Targeted by Internet Scanners
The second vulnerability is CVE-2026-25895, which has a CVSS score of 9.5.
The vulnerability affects FUXA versions 1.2.9 and earlier.
FUXA is a web based SCADA and HMI platform designed for operational technology and industrial automation environments.
The flaw combines missing authentication for a critical function with path traversal. An unauthenticated remote attacker can potentially write arbitrary files to the server's filesystem and achieve remote code execution.
Malicious Scanning Detected
VulnCheck reported malicious scanning for CVE-2026-25895 beginning on August 18, 2026.
Researchers observed an IP address broadly scanning the internet for vulnerable FUXA installations.
VulnCheck estimates that approximately 60 FUXA installations are publicly exposed.
The observed attacker attempted to exploit the path traversal vulnerability to overwrite the FUXA main.js file with junk data.
No remote code execution payload had been observed at the time of the report.
Previous FUXA Vulnerabilities Also Exploited
FUXA has previously been targeted through other vulnerabilities.
Researchers have observed exploitation activity involving CVE-2026-25939 and CVE-2023-33831.
According to VulnCheck, exploitation of CVE-2023-33831 dates back to November 2025 and continued into August 2026.
The repeated targeting of FUXA vulnerabilities highlights the risk of exposing industrial automation software directly to the public internet.
Security Recommendations
Organizations running MLflow or FUXA should take immediate steps to reduce their exposure.
For MLflow:
- Upgrade to MLflow 3.15.0 or later
- Restrict access to MLflow Tracking Servers
- Review logs for suspicious requests to cloud metadata services
- Check cloud credentials and tokens for unauthorized access
- Rotate potentially exposed credentials
- Monitor unexpected outbound connections
For FUXA:
- Upgrade to a version containing the security fix
- Remove publicly accessible FUXA instances from the internet where possible
- Restrict access through VPNs or network controls
- Review server files for unauthorized modifications
- Monitor for suspicious requests and unexpected processes
- Investigate systems showing signs of exploitation
The active scanning of both vulnerabilities shows how quickly attackers can weaponize newly disclosed flaws, particularly when vulnerable AI and industrial systems are directly exposed to the internet.
