Back Securityweek

Critical Node

Securityweek •Ionut Arghire • November 3, 2026

Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.

Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.

Tracked as CVE-2026-58115 (CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.

Siemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.

According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”

On Sunday, VulnCheck warned that it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.

“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.

The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.

According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.

“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.

Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs

Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Node-RED Flaw Exploited to Deploy Linux Malware A critical vulnerability, CVE-2026-58115, in Node-RED has been to deploy Linux malware on Siemens SIMATIC IoT2050 Advanced devices. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to create malicious flows that execute arbitrary code. VulnCheck reported that on October 30, 2026, an attacker sent a complete exploit request from an IP in Microsoft's ASN, triggering a Node-RED flow that downloaded a bot binary. Between October 30 and November 1, the same IP address attempted to exploit this vulnerability 16 times. The attacks involve using an inject node to automatically trigger an exec node, which runs shell commands. Siemens had disclosed this vulnerability in August 2026, with patches available in Industrial OS version 4.3.4.1 and later. The ongoing exploitation highlights the urgent need for organizations to secure their Node-RED installations. 18 sources 75

Extracted Entities

Critical Node

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (2)

Platforms (1)