Node-RED authentication hole being exploited in the wild
Attackers are exploiting CVE-2026-58115 to deploy flows that download and run a Linux bot on unpatched Node-RED instances.
85
Product
Node-RED
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenNov 2, 2026
- Last mentioned2h ago
Timeline
5 articles · newest firstAttackers exploit Node-RED CVE-2026-58115 to deploy Linux bot and backdoors
VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
95
Critical Node-RED flaw exploited in attacks
Attackers deploy Linux bots and webshells via single HTTP request; Siemens devices patched.
70
Attackers exploit Siemens IoT2050 missing authentication flaw
VulnCheck observed in-the-wild exploitation of CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Node-RED flows that download and run Linux bots.
90
Max-severity Node-RED bug exploited to deploy Linux malware in OT
VulnCheck documented exploitation of CVE-2026-58115 allowing unauthenticated flows to execute commands on Siemens devices.
80
Related CVEs
by mentions- CVE-2026-58115<1%10.0A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed)
Appears with
- Siemensvendor · 5
- SIMATIC IoT2050 Advancedproduct · 3
- VulnCheckorganization · 2
- Linux botmalware · 2
- SIMATIC IoT2050product · 1
- bot-linux-amd64malware · 1
- VulnCheckvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.