Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot. Node-RED is commonly used for workflow automation in industrial control systems (ICS) and operational technology (OT) environments. It’s built on top of Node.js and is used in commercial products including Siemens SIMATIC IoT2050. In August, Siemens assigned the vulnerability identifier – CVE-2026-58115 – to describe the bug and explain its perfect 10-out-of-10 CVSS rating. Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands on the device. This means unauthenticated remote attackers can create malicious flows, which is what VulnCheck researchers began documenting last Friday. “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115,” VulnCheck researcher Patrick Garrity warned in a Monday advisory, adding that two Node-RED built-in nodes make this vulnerability “trivial to weaponize.” One is an inject node, which fires a message either on a schedule or once at startup. The second, an exec node, can run shell commands. “Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity said. Plus, these exploits come as criminals increasingly look to target internet-expo...
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
The Register
·Published Nov 2, 2026
·Updated
Affected Software
2 affected components
Node-RED Node-RED
Siemens SIMATIC IoT2050
Frequently Asked Questions
1
Which systems are affected by CVE-2026-58115?
The vulnerability affects Siemens devices that use Node-RED and do not enforce authentication on the Node-RED HTTP interface. The article identifies Siemens SIMATIC IoT2050 as a commercial product that uses Node-RED.
2
How can an attacker exploit this vulnerability?
An unauthenticated remote attacker can access programming nodes through the Node-RED HTTP interface and create malicious flows that execute system commands on the device. Researchers said two built-in Node-RED nodes make the issue trivial to weaponize.
3
Is exploitation of the vulnerability confirmed?
Yes. VulnCheck reported that one of its canaries detected an attacker exploiting CVE-2026-58115 on October 30, 2026. The observed malicious flow downloaded and ran a Linux bot, while the criminals behind the activity remain unknown.