There is an active exploit of a critical security vulnerability in Node-RED by threat actors to install malicious Linux bots and webshells on vulnerable systems. It is believed that the attacks, detected by cybersecurity firm VulnCheck, could result in compromised instances and industrial environments being exposed to remote command execution and unauthorized access.
Tracked as CVE-2026-58115, the vulnerability has a CVSS severity rating of 10.0.
Node-RED HTTP interface does not contain authentication, allowing remote attackers to access programming functions and execute system commands on the underlying server if unauthenticated remote attackers are not authenticated.
A browser-based editor enables users to build event-driven applications using Node-RED, an open-source, flow-based programming tool. It is widely used in industries including manufacturing, healthcare, home automation, and industrial control systems.
A number of Siemens IoT2050 Advanced devices have been integrated with the platform, including Siemens SIMATIC IoT2050 Advanced devices.
Siemens disclosed the vulnerability on August 11, 2026, after identifying the issue with SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. In order to take advantage of this vulnerability, attackers could create malicious programming flows and execute arbitrary code with maximum privileges if it is successfully exploited.
A fix for the vulnerability is available in Siemens SIMATIC IoT2050 Advanced version 4.3.4.1 and later. Although security updates have been available, attackers continue to target vulnerable instances. A malicious request containing a complete exploit was captured by one of VulnCheck's monitoring systems on October 30, when it was detected as successful exploitation. This attack deployed a Node-RED flow, triggered its execution automatically, and downloaded a binary from a server controlled by the attacker.
A malicious execution flow was initiated using Node-RED components, including the inject and execute nodes, without requiring additional interaction from the attacker. There has been no indication of the exact purpose of the downloaded binary, identified as bot-linux-amd64, which was stored under a hidden filename in a memory-backed location and executed in the background.
Researchers were unable to retrieve the binary for further examination.
During the exploitation campaign conducted between October 30 and November 1, repeated attempts were made from the same IP address. The attack vectors used by VulnCheck are 16 attempts to exploit CVE-2026-58115, with attackers delivering a variety of payloads across multiple requests.
The address used by the attackers originates from Microsoft's AS8075 network, which is located in Brazil.
A researcher cautioned that the use of cloud providers' networks does not necessarily identify threat actors, since such infrastructure may include virtual machines rented or compromised by cloud providers. Other attempts were made to install webshells, which gave attackers access to compromised servers and the ability to execute commands remotely, in addition to deploying Linux bots.
In some instances, additional shell scripts and files appeared to be legitimate Linux kernel processes.
As opposed to the originally observed bot, which was stored in memory and could be removed when the system was rebooted, the webshells provided a more persistent method of access. In addition to identifying broader scanning activity from the same IP address, VulnCheck also recorded 125 requests targeted at eight different vulnerabilities affecting Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla.
A survey of Node-RED installations indicates opportunistic mass scanning rather than activity concentrating exclusively on Node-RED installations Security experts have expressed concerns about the vulnerability of industrial environments through poorly secured Node-RED deployments.
Industrial controllers are often integrated with databases, messaging systems and cloud services through this platform, allowing the platform to hold credentials for multiple connected systems. Consequently, a compromised instance could give attackers access beyond the initial server and facilitate movement across networks in the areas of information technology and operational technology.
It is also important to note that Node-RED deployments are not always managed by dedicated IT security teams, increasing the risk.
It is common for engineers and operational staff to configure Node-RED installations directly, thus preventing regular asset inventories and security monitoring. Additionally, scheduled maintenance requirements can delay firmware updates in industrial environments, resulting in vulnerable devices remaining exposed even after patches have been released.
CVE-2026-58115 has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog in response to the observed attacks. When reported, this vulnerability was not listed in CISA's KEV catalog. It is recommended that organizations using Node-RED apply security updates, enable authentication via the adminAuth setting, and restrict external network access to the editor.
The security team should also examine deployed flows for unanticipated executable nodes, unauthorized HTTP endpoints, and suspicious file modifications. It is equally important to examine system logs and outbound network connections for signs of compromise, as installing patches alone may not remove webshells or other malicious components already present on the system.
Node-RED deployments exposed to industrial environments may pose security risks resulting from the active exploitation of CVE-2026-58115. It is recommended that organizations prioritize patching, enforce authentication, limit access to the editor and investigate for signs of compromise. In light of the possibility of existing webshells remaining after updates have been applied, security checks should accompany remediation efforts as well.
