The Hacker News on X: " Critical Siemens IoT2050 flaw under active exploitation ...

X • November 3, 2026

The Hacker News @TheHackersNews 🚨 Critical Siemens IoT2050 flaw under active exploitation. Attackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED. VulnCheck captured the exploit attempts on its honeypots. How the attacks work ↓ thehackernews.com/2026/11/attack… 6:00 AM · Nov 3, 2026 · 23.9K Views 18

Cipher0k @theaihacker 8h cvss 10 and already hitting vulncheck's honeypots is the kind of iot2050 patch that skips the maintenance window

Wraith @Wraithioner 5h Industrial gateways like the IoT2050 tend to run for years on a factory floor without anyone checking them. Once attackers get in, Node-RED gives them a ready-made way to run commands on it

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Node-RED Flaw Exploited to Deploy Linux Malware A critical vulnerability, CVE-2026-58115, in Node-RED has been to deploy Linux malware on Siemens SIMATIC IoT2050 Advanced devices. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to create malicious flows that execute arbitrary code. VulnCheck reported that on October 30, 2026, an attacker sent a complete exploit request from an IP in Microsoft's ASN, triggering a Node-RED flow that downloaded a bot binary. Between October 30 and November 1, the same IP address attempted to exploit this vulnerability 16 times. The attacks involve using an inject node to automatically trigger an exec node, which runs shell commands. Siemens had disclosed this vulnerability in August 2026, with patches available in Industrial OS version 4.3.4.1 and later. The ongoing exploitation highlights the urgent need for organizations to secure their Node-RED installations. 18 sources 75

Extracted Entities

The Hacker News on X: " Critical Siemens IoT2050 flaw under active exploitation ...

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)