Exploited within hours: MLflow SSRF and FUXA auth bypass join the emergency patch list

Two unauthenticated critical bugs, one in the MLflow AI platform and one in the FUXA SCADA/HMI package, are drawing active scanning and exploitation, according to separate reports from watchTowr and VulnCheck ^[1][2]. The practical consequence is that the machine learning tracking server your data science team stood up last quarter and the web HMI on the plant network now sit in the same triage bucket as an internet-facing VPN appliance.

The MLflow issue is CVE-2026-64849, rated CVSS 9.3: an unauthenticated server-side request forgery that lets anyone who can reach the Tracking Server issue HTTP requests to arbitrary internal cloud metadata endpoints and pull out sensitive data, affecting versions below 3.15.0 ^[3]. watchTowr says attackers are exploiting it to reach cloud metadata services directly and exfiltrate cloud credentials and secrets ^[4]. Yordan Ganchev, principal threat intelligence specialist at watchTowr, said the flaw sits in MLflow's model-registry webhooks and lets an attacker proxy requests through the affected system to interact with internal services ^[5]. Ganchev also said the bug bypasses prior fixes because of how it handles web redirects, and that the firm's global honeypot telemetry shows attackers going after cloud-hosted MLflow instances to extract credentials and secrets from well-known internal IP addresses and services ^[6][7].

Note the timeline. watchTowr says it saw indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on August 17, 2026 ^[8]. That is not a patch window; it is a race you have already partly lost if the instance was exposed. watchTowr's guidance is unglamorous and correct: patch exposed systems first, review audit logs for signs of compromise, and check whether sensitive credentials have been exposed ^[9]. The last item is the one teams skip. An SSRF that reaches instance metadata is a credential theft primitive, so the incident does not end when the server is upgraded.

The OT half is CVE-2026-25895, CVSS 9.5, a missing authentication for a critical function combined with path traversal in FUXA, an open-source web-based SCADA/HMI product used in industrial automation ^[2][10]. An unauthenticated remote attacker can write arbitrary files to the file system and reach remote code execution, in versions up to and including 1.2.9 ^[10]. VulnCheck says malicious scanning began on August 18, 2026, one day after the MLflow CVE was assigned, with a single IP address broadly scanning the internet ^[11][12][13]. Caitlin Condon, VulnCheck's vice president of research, said the observed requests try to overwrite main.js with junk data via the traversal, and that no RCE payloads have been dropped yet ^[14].

Exposure here is small: roughly 60 FUXA installations are reachable from the public internet ^[15]. Small does not mean unimportant when the software drives a physical process, and FUXA is not new to this. Condon said two other FUXA flaws, CVE-2026-25939 and CVE-2023-33831, have also seen active exploitation over the past year, with activity against the older bug dating back to November 2025 and continuing as recently as the day before her post ^[16]. That makes three FUXA CVEs under exploitation pressure, counting the current one ^[17].

What to watch: whether the FUXA scanning moves from junk-data writes to working web shells, whether any second IP joins the single scanner VulnCheck has seen, and whether the MLflow credential thefts surface as downstream cloud intrusions rather than as MLflow incidents.