Skip to content
Critical Node-RED Flaw Exploited to Deploy Linux Malware

Critical Node-RED Flaw Exploited to Deploy Linux Malware

First seen 3 Nov 2026, 06:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 22:46 UTC
  • •CVE-2026-58115 is a critical flaw in Node-RED, allowing unauthenticated remote code execution.
  • •Exploitation was confirmed by VulnCheck, with 16 attempts logged from a single IP in Microsoft's ASN.
  • •Siemens has released patches for affected devices, but many remain vulnerable.

A critical vulnerability, CVE-2026-58115, in Node-RED has been to deploy Linux malware on Siemens SIMATIC IoT2050 Advanced devices. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to create malicious flows that execute arbitrary code. VulnCheck reported that on October 30, 2026, an attacker sent a complete exploit request from an IP in Microsoft's ASN, triggering a Node-RED flow that downloaded a bot binary. Between October 30 and November 1, the same IP address attempted to exploit this vulnerability 16 times. The attacks involve using an inject node to automatically trigger an exec node, which runs shell commands. Siemens had disclosed this vulnerability in August 2026, with patches available in Industrial OS version 4.3.4.1 and later. The ongoing exploitation highlights the urgent need for organizations to secure their Node-RED installations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-08-11
CVE-2026-58115 published
Siemens disclosed a critical authentication bypass flaw in Node-RED affecting IoT2050 devices.
Finance.Biggo
2026-10-30
Active exploitation observed
VulnCheck detected an attacker exploiting CVE-2026-58115, deploying a malicious Node-RED flow.
Vulncheck
2026-11-01
Multiple exploit attempts logged
The same attacker targeted the Node-RED flaw 16 times over three days, indicating ongoing exploitation.
Helpnetsecurity

More articles in this cluster (26)

Following this threat?

Track Siemens and CVE-2019-17558 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 4

Common questions

Which devices are affected by CVE-2026-58115?
The vulnerability affects Siemens SIMATIC IoT2050 Advanced devices running versions of Industrial OS prior to 4.3.4.1.
What should organizations do to protect themselves?
Organizations should apply the latest patches from Siemens and ensure that authentication is enabled on their Node-RED installations.
How is the vulnerability being exploited?
Attackers exploit the flaw by sending a single HTTP request to deploy malicious Node-RED flows that execute arbitrary code.