Node-RED’s CVSS 10 flaw is being used to deploy Linux malware

Feeds.4Sysops •IT News • November 3, 2026

Node-RED, a flow-based automation tool used in industrial control and operational technology systems, is being exploited to install Linux malware on vulnerable devices. The flaw, CVE-2026-58115, lets remote attackers create flows without authentication; Siemens rated it CVSS 10. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Siemens IoT2050 Flaw Exploited for Linux Malware Deployment A critical vulnerability, CVE-2026-58115, affecting Siemens SIMATIC IoT2050 Advanced gateways has been. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to execute arbitrary code by exploiting a missing authentication in the Node-RED HTTP interface. VulnCheck reported that attackers have begun using this vulnerability to install persistent Linux backdoors. The first recorded exploit occurred on October 30, 2026, with attackers deploying a malicious Node-RED flow that downloads and executes a bot binary. The attacks were traced back to a single IP address geolocated in Brazil, which targeted the flaw 16 times in just a few days. Siemens has recommended updating to Industrial OS version 4.3.4.1 or later to mitigate the risk. The ongoing exploitation highlights the urgent need for organizations using affected devices to secure their installations immediately. 5 sources 80

Extracted Entities

Node-RED’s CVSS 10 flaw is being used to deploy Linux malware

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)