Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

MLflow and FUXA active exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 46
3 unique sources, 3 articles

Summary

Hide ▲

Active scanning and exploitation of MLflow and FUXA vulnerabilities is putting exposed systems at risk of cloud credential theft and remote code execution. CVE-2026-64849 in MLflow and CVE-2026-25895 in FUXA are both being targeted in the wild. The activity spans internet-wide probing of public instances and abuse attempts against reachable systems. The wave surfaced on August 17-18, 2026 and remains active.

Related Happenings

MLflow unauthenticated SSRF flaw (CVE-2026-64849)

Vulnerability
H score43 First: 18.08.2026 20:44 Last: 18.08.2026 20:44 Sources 1

How related: Tracked as CVE-2026-64849, this critical DNS-rebinding server-side request forgery (SSRF) bypass in MLflow's outbound webhook delivery was patched in version 3.15.0 and can be used by attackers without privileges to remotely access internal services or cloud metadata configurations on unpatched instances.

About this happening: CVE-2026-64849 in MLflow is being actively exploited against exposed Tracking Server deployments, creating immediate risk of cloud credential and secret theft. Attacke...

Open Happening

FUXA path traversal flaw (CVE-2026-25895, actively scanned)

Vulnerability
H score49 First: 18.08.2026 20:44 Last: 18.08.2026 20:44 Sources 1

How related: "The attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal," Caitlin Condon, vice president of research at VulnCheck, said in a LinkedIn post. "No RCE payloads dropped yet."

About this happening: Malicious scanning is targeting CVE-2026-25895 in FUXA <= 1.2.9, putting publicly exposed SCADA/HMI instances at risk of arbitrary file write and potential remote code...

Open Happening

JDY botnet expanded reconnaissance and flaw-focused scanning activity

Malware Activity
H score27 First: 10.06.2026 18:00 Last: 10.06.2026 18:00 Sources 1

About this happening: The JDY botnet has expanded its reconnaissance and flaw-focused scanning, increasing the risk that exposed infrastructure will be rapidly identified and targeted. Research...

Open Happening

Langflow and Trend Micro Apex One exploited flaws (multiple vulnerabilities)

Vulnerability
H score44 First: 22.05.2026 08:47 Last: 22.05.2026 08:47 Sources 1

About this happening: CISA added CVE-2025-34291 in Langflow and CVE-2026-34926 in Trend Micro Apex One to the KEV catalog after evidence of active exploitation. The Langflow...

Open Happening

React Native Metro servers Metro4Shell exploitation wave (CVE-2025-11953)

Exploitation Wave
H score50 First: 03.02.2026 16:00 Last: 03.02.2026 16:00 Sources 1

About this happening: Repeated exploitation of CVE-2025-11953 is hitting exposed React Native Metro servers, creating remote command and payload-delivery risk across a large development-systems...

Open Happening

Timeline

  1. 20.08.2026 14:06 1 articles · 12d ago

    CISA adds MLflow CVE-2026-64849 to exploited-in-the-wild catalog

    Legal Policy Action Update

    CISA added CVE-2026-64849 to its catalog of flaws exploited in the wild and ordered U.S. Federal Civilian Executive Branch agencies to secure MLflow instances within two weeks under Binding Operational Directive 26-04. The vulnerability is a critical DNS-rebinding server-side request forgery bypass in MLflow's outbound webhook delivery and can let an unauthenticated attacker reach internal services or cloud metadata endpoints on unpatched instances.

    Show sources
    Open in new tab
  2. 18.08.2026 20:44 2 articles · 13d ago

    Attackers target MLflow CVE-2026-64849 for cloud metadata access

    Exploitation Observed

    watchTowr says attackers are exploiting CVE-2026-64849 in MLflow to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data, with indiscriminate scanning for exposed MLflow instances appearing within hours of the CVE assignment on August 17, 2026.

    Show sources
    Open in new tab
  3. 18.08.2026 20:44 1 articles · 13d ago

    Malicious scanning targets FUXA CVE-2026-25895

    Exploitation Observed

    VulnCheck said malicious scanning aimed at CVE-2026-25895 in FUXA began on August 18, 2026, and observed request attempts to overwrite main.js with junk data through the path traversal flaw; the vulnerability can let an unauthenticated remote attacker write arbitrary files to the server file system and achieve remote code execution.

    Show sources
    Open in new tab
  4. 18.08.2026 20:44 2 articles · 13d ago

    watchTowr and VulnCheck disclose active exploitation of MLflow and FUXA flaws

    Initial Disclosure

    Independent reports from watchTowr and VulnCheck say MLflow CVE-2026-64849 and FUXA CVE-2026-25895 are witnessing malicious scanning and exploitation efforts, with MLflow attackers using SSRF to reach cloud metadata services and exfiltrate cloud credentials and secrets while FUXA probes attempt file overwrite via path traversal.

    Show sources
    Open in new tab