Attackers are exploiting a maximum-severity flaw in Node-RED to deploy flows that download and run a Linux bot. The flaw, CVE-2026-58115, rated 10.0 out of 10 on the CVSS scale, is a missing-authentication weakness in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS. Siemens published its advisory, SSA-834709, on 11 August 2026, with the fix in Industrial OS version V4.3.4.1 — so this is a patched flaw now being exploited, not a zero-day.

Two built-in nodes are enough

VulnCheck caught the first exploitation on 30 October, when one of its decoy "canary" systems recorded an attacker exploiting the flaw. Two built-in Node-RED nodes make the attack simple: an inject node fires a message on a schedule or at startup, and an exec node runs shell commands. Wiring the two together lets an unauthenticated attacker run commands with maximum privileges.

Between 30 October and 1 November, the same source address hit the flaw 16 times on VulnCheck's canaries. The address geolocates to Brazil, but that does not identify who is behind the activity, and no group has been named.

What the attackers delivered

The observed flows downloaded a Linux binary, seen under the filename bot-linux-amd64, and staged downloaders and flow-based webshells. VulnCheck did not retrieve or analyse the downloaded binary, so what it does once running — whether it is a bot, a miner or something else — has not been established.

The researchers describe the activity as opportunistic mass scanning rather than a targeted attack on a particular plant. The evidence so far comes from honeypot observations only; no compromises at real industrial operators have been confirmed. Operators should update affected devices to V4.3.4.1 or later, switch on Node-RED's built-in authentication, or uninstall Node-RED — and keep industrial systems off the public internet.

Sources: The Register, 2 November 2026; VulnCheck, Exploitation targeting Node-RED, 2 November 2026; SANS Internet Storm Center, 4 November 2026.