Exposed MLflow servers are under active attack, with intruders using a server-side request forgery to pull cloud credentials straight from metadata endpoints. watchTowr spotted scanning within hours of CVE-2026-64849 being assigned on August 17.
The CVSS 9.3 flaw affects MLflow versions before 3.15.0. It lives in the model-registry webhooks of the open-source AI platform, letting anyone who can reach the Tracking Server proxy requests to internal services. Earlier fixes do not stop it because the bug survives web redirects.
“Attackers are exploiting this to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets,” watchTowr said. Honeypot telemetry shows them probing cloud-hosted MLflow systems for well-known internal IP addresses.
Operators should patch exposed systems first, then review audit logs for compromise and check whether sensitive credentials leaked.
A second flaw, CVE-2026-25895, hit FUXA, a web-based SCADA/HMI platform for industrial automation. Rated CVSS 9.5 and present through version 1.2.9, it pairs missing authentication with path traversal, letting a remote attacker write arbitrary files and gain code execution. VulnCheck saw a single IP sweeping the internet for the bug starting August 18, with roughly 60 FUXA installs exposed.
VulnCheck’s Caitlin Condon said those requests aim to overwrite main.js with junk data through the traversal, and no working RCE payloads have surfaced yet.
Two earlier FUXA bugs, CVE-2026-25939 and CVE-2023-33831, also drew exploitation over the past year, with the latter active as recently as yesterday.
