Maximum-severity Node-RED flaw exploited to deliver Linux malware | Межа

Attackers are exploiting CVE-2026-58115, a flaw rated 10 out of 10 on the CVSS scale, to deploy a flow that downloads and runs a Linux bot.

Node-RED is a flow-based programming tool built on Node.js and commonly used for workflow automation in industrial control systems and operational technology environments. It is included in commercial products such as Siemens SIMATIC IoT2050. In August, Siemens assigned the flaw the identifier CVE-2026-58115 and described its 10-out-of-10 CVSS rating.

This is reported by The Register .

Affected Siemens devices do not require authentication on the Node-RED HTTP interface, leaving programming nodes that can execute system commands accessible without authentication. Remote attackers can therefore create malicious flows. VulnCheck researchers began documenting such activity last Friday. In a Monday advisory, researcher Patrick Garrity said one of the company’s canaries caught an attacker exploiting the flaw on October 30, 2026.

Garrity said two built-in Node-RED nodes make the flaw easy to weaponize: an inject node, which sends a message on a schedule or once at startup, and an exec node, which can run shell commands. Connecting them lets a flow execute a command as soon as it is deployed, without further interaction, he said.

VulnCheck observed activity from a single IP address, 4.201.105[.]116, which is on Microsoft’s AS8075 network and geolocates to Brazil. Garrity said it sent the complete exploit, flow and dropper in a single POST /flows. From October 30 through November 1, the address targeted this Node-RED flaw 16 times and logged 125 hits against eight different CVEs across VulnCheck’s wider canary network.

Targets also included CVE-2019-17558, a seven-year-old Apache Solr flaw affecting Camunda, Gitea, MLflow, Traefik and Joomla. Garrity said the mix of old and new flaws in unrelated products suggests opportunistic mass scanning rather than a targeted attack. One hit delivered a different payload pointing to another server, 85.215.73[.]250, which VulnCheck is tracking but for which it has no telemetry beyond the URL. Garrity said the separate download host suggests a scan-and-infect setup in which hosts that find and exploit vulnerable systems retrieve the implant from a dedicated server.

The researchers did not retrieve a binary or staged scripts for analysis. The filename, bot-linux-amd64, indicates the malware targets Linux on AMD64 processors and suggests its operator may have other builds. Garrity said they could not determine what the malware does once running.

VulnCheck’s findings come as criminals increasingly target internet-exposed OT and industrial control systems, which can enable attacks to affect the physical world and cause real-life harm. The source cites ongoing refrigeration-controller hacks across Europe and attacks on water systems in at least 12 US states over the summer. Garrity advised anyone running Node-RED, including in OT environments, to check whether it is reachable from outside their network, apply available updates and implement detections to reduce the risk of exploitation.

The flaw has been added to VulnCheck’s Known Exploited Vulnerabilities catalog. As of press time, it had not appeared in the US Cybersecurity and Infrastructure Security Agency’s KEV catalog.