Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.
Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.
Tracked as CVE-2026-58115 (CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.
Siemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.
According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”
On Sunday, VulnCheck warned that it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.
“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.
The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.
According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.
“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.
Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
Android’s November 2026 Updates Patch Over 200 Vulnerabilities
The most severe is a critical flaw in Framework leading to remote code execution without user interaction.
Over 100 European Stores Hit as Supermarket Fridge Attacks Return
Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond.
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
