Attackers exploit Node-RED CVE-2026-58115 to deploy Linux bot and backdoors
Original title: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
VulnCheck detects in-the-wild exploitation of CVE-2026-58115 deploying a Linux bot and webshells.
Attackers exploit an authentication flaw in Node-RED to install Linux bots and backdoors on unprotected servers. Siemens disclosed the critical vulnerability (CVSS 10.0) in August, affecting versions before V4.3.4.1 in Industrial OS. VulnCheck observed the exploit on October 30, 2026, from a Brazilian IP, deploying malicious flows and payloads.
Unconfirmed: The nature of the downloaded bot remains unknown as VulnCheck did not retrieve it.
- VulnCheck caught the exploit using canaries on October 30, 2026.
- Deployed Node-RED flow with inject and exec nodes.
- Downloaded bot-linux-amd64 from attacker server.
- Also deployed webshells for persistence.
- Affected SIMATIC IoT2050 Advanced devices.
Impact: remote code execution with maximum privileges
- 1.Upgrade Node-RED to V4.3.4.1
- 2.Check if Node-RED instances are exposed to the internet
- 3.Implement detections for Node-RED flows
- CVEs
- CVE-2026-58115
- Products
- Node-REDSIMATIC IoT2050 Advanced
- Malware
- bot-linux-amd64
- Countries
- Brazil
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% |
From the original article
3 min read at helpnetsecurity.com
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprotected servers, VulnCheck has found. Node-RED is a flow-based programming tool built on Node. js that lets users wire together event-driven applications in a browser-based editor.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.