Summary
- A CVSS 10.0 vulnerability in Node-RED (CVE-2026-58115) is being actively exploited in the wild, with VulnCheck’s canary systems catching live attacks from 30 October 2026.
- Affected Siemens SIMATIC IoT2050 devices expose the Node-RED HTTP interface without authentication, allowing unauthenticated remote attackers to deploy and execute arbitrary flows.
- A single IP address launched 16 targeted exploit attempts in three days, delivering a Linux bot (bot-linux-amd64) pulled from a separate dedicated dropper server.
- The attacker also scanned for seven other CVEs across unrelated products, suggesting opportunistic mass scanning rather than a focused campaign.
- The vulnerability is in VulnCheck’s KEV catalogue but had not appeared in CISA’s KEV at time of publication.
The vulnerability
Node-RED is a flow-based programming tool built on Node.js, widely used for workflow automation in industrial control systems and operational technology environments. Siemens ships it as part of the SIMATIC IoT2050 product line. In August, Siemens assigned CVE-2026-58115 to a flaw in how affected devices handle the Node-RED HTTP interface: authentication is simply not enforced. Any unauthenticated remote actor who can reach that interface can create and deploy flows — and flows can execute system commands.
Why exploitation is straightforward
VulnCheck researcher Patrick Garrity explains the mechanism plainly. Node-RED includes two built-in nodes that make this trivial to weaponise. An inject node fires a message on a schedule or at startup. An exec node runs shell commands. “Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity wrote. There is no special tooling required and no authentication to bypass — the interface is simply open.
What VulnCheck observed
On 30 October 2026, a VulnCheck canary system caught a live exploit attempt targeting this vulnerability. Between 30 October and 1 November, researchers logged 16 exploit attempts against Node-RED from a single IP address — 4.201.105[.]116 — which sits within Microsoft’s AS8075 network and geolocates to Brazil. The attacker did not probe first and escalate later. “It didn’t just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows,” Garrity noted. The payload attempted to download a file named bot-linux-amd64, indicating Linux malware targeting AMD64 processors. The filename convention suggests the operator may maintain builds for other architectures as well.
A separate dropper infrastructure
The download host for the malware binary was a different machine — 85.215.73[.]250 — from the one sending the exploit. VulnCheck is now tracking that server but has no additional telemetry beyond the URL. Garrity’s assessment is that this reflects a typical scan-and-infect arrangement: one set of hosts identifies and exploits vulnerable systems, while a dedicated server serves the implant. The researchers did not retrieve the binary, so the malware’s full capabilities remain unknown.
Broader scanning activity
The same IP address logged 125 hits across eight different CVEs against VulnCheck’s wider canary network over the same period. Among the targets was a seven-year-old Apache Solr flaw, CVE-2019-17558, alongside vulnerabilities affecting Camunda, Gitea, MLflow, Traefik, and Joomla. The mix of old and new flaws across entirely unrelated products points to opportunistic mass scanning. There is no evidence at this stage of a targeted campaign against any specific organisation or sector.
OT exposure as a broader pattern
This activity arrives against a backdrop of increasing attacker interest in internet-exposed OT and ICS devices. The sources note ongoing refrigeration controller compromises across Europe and attacks on water systems across at least twelve US states over the northern summer. Node-RED’s presence in critical infrastructure amplifies the risk profile of this particular vulnerability beyond a typical enterprise software flaw.
Current status
CVE-2026-58115 has been added to VulnCheck’s Known Exploited Vulnerabilities catalogue. As of the time of publication, it had not appeared in CISA’s KEV catalogue. Organisations relying on CISA KEV as a sole prioritisation signal should be aware of that gap.
Why it matters
Node-RED sits at the intersection of IT and OT — it is the kind of tool that security teams often overlook because it lives on the engineering side of the house rather than the enterprise network. A CVSS 10.0 rating with confirmed in-the-wild exploitation means this is not a theoretical risk. Siemens SIMATIC IoT2050 devices are deployed in critical infrastructure environments where a compromised flow could affect physical processes. The unauthenticated HTTP interface means network exposure alone is sufficient for full compromise. CISOs need to confirm whether Node-RED instances in their environment — including those inside OT networks — are reachable from outside, and act accordingly. Waiting for CISA KEV inclusion before prioritising this would be a mistake.
What to do now
- Audit all Node-RED deployments in your environment, including those embedded in Siemens SIMATIC IoT2050 and similar OT devices, and determine whether the HTTP interface is reachable from outside your network.
- Apply available updates for Node-RED and affected Siemens firmware as published in Siemens’ security advisory for CVE-2026-58115.
- Where patching is not immediately possible, restrict network access to Node-RED HTTP interfaces using firewall rules or network segmentation to prevent unauthenticated external access.
- Implement detections for anomalous flow deployments and unexpected outbound connections from Node-RED hosts, particularly to unfamiliar external IP addresses.
- Do not rely solely on CISA KEV for patch prioritisation — check VulnCheck’s KEV catalogue and vendor advisories as additional signals.
