Critical Node-RED Flaw CVE-2026-58115 Exploited to Infect OT Devices

Active Exploitation Targets Industrial IoT

Attackers have begun actively exploiting a maximum-severity Node-RED vulnerability tracked as CVE-2026-58115 to breach industrial control systems and deploy Linux botnet implants. First assigned by Siemens in August 2026 with a CVSS score of 10.0, the flaw affects industrial Operational Technology (OT) automation gateways—including the Siemens SIMATIC IoT2050—that leave their Node-RED management interfaces exposed to the public internet without administrative authentication.

Security researchers at VulnCheck documented live exploitation attempts starting October 30, 2026, when honeypot canaries intercepted automated attacks deploying malicious Node-RED flows. Instead of relying on a multi-stage intrusion sequence, threat actors are leveraging built-in features of the Node-RED flow editor to turn unauthenticated HTTP access into instant remote code execution (RCE) on the underlying host operating system.

Technical Mechanics of CVE-2026-58115

Node-RED is a flow-based, visual programming engine built on Node.js widely used across operational technology and Internet of Things (IoT) environments to route data between sensor networks, programmable logic controllers (PLCs), and cloud infrastructure.

The core vulnerability in affected implementations—such as default or misconfigured deployments on Siemens SIMATIC IoT2050 devices—is a complete lack of authentication on the Node-RED HTTP management interface. Anyone who can reach the web console over the network has full access to the flow editor API.

Weaponizing this flaw is trivial because Node-RED natively includes utility nodes designed to interface directly with the underlying Linux host system:

• inject node: A trigger node configured to send a message payload automatically upon startup or on a defined schedule.
• exec node: A system execution node that runs arbitrary shell commands on the system hosting Node-RED.

By sending a single POST /flows HTTP request to an exposed device, an attacker can deploy a flow that wires an inject node directly into an exec node. As soon as Node-RED receives and processes the updated flow configuration, the inject node fires on deployment, causing the exec node to execute arbitrary shell commands with the privileges of the Node-RED process. This requires zero prior credentials, user interaction, or secondary privilege escalation steps.

Observed Attack Activity and Indicators

Telemetry captured between October 30 and November 1, 2026, reveals an automated mass-scanning operation targeting exposed Node-RED instances alongside multiple legacy software flaws.

The observed attack traffic originated from a single IP address:

• Scanner IP: 4.201.105[.]116 (Microsoft AS8075 infrastructure, geolocated to Brazil)

Rather than performing preliminary banner grabbing or manual testing, the attacking host delivered a fully formed exploit payload inside a single POST /flows request. The malicious flow instructed the target host to download and run an executable binary named bot-linux-amd64.

The payload retrieval attempt pointed to a separate, dedicated staging server:

• Payload Server: 85.215.73[.]250

This separation between the scanning/exploiting host and the payload host indicates a standard scan-and-infect infrastructure pattern common in botnet propagation. Across the monitoring window, the same attacking IP address targeted the Node-RED vulnerability 16 times and logged 125 total hits against eight distinct vulnerabilities across the monitor network, including a seven-year-old Apache Solr vulnerability (CVE-2019-17558). This broad target profile confirms that the threat actor is running opportunistic, wide-net internet scans rather than a targeted campaign against a specific enterprise.

The binary name bot-linux-amd64 indicates that the implant targets 64-bit Linux architectures commonly running on x86-64 industrial PCs, though operators running mass-scanning botnets frequently maintain cross-compiled variants for ARM architectures prevalent in embedded IoT gateways.

Impact and Blast Radius in OT Environments

While Node-RED is frequently deployed in IT settings for lightweight workflow automation, its widespread adoption in industrial IoT gateways makes unauthenticated RCE exceptionally hazardous. Industrial gateways like the Siemens SIMATIC IoT2050 sit at the boundary between IT networks and physical operational technology environments.

Compromising an OT gateway gives an adversary an initial foothold inside critical infrastructure networks. An attacker establishing shell access on an IoT gateway can:

• Intercept, modify, or inject telemetry data between field sensors and supervisory control and data acquisition (SCADA) systems.
• Pivot directly into internal OT subnets to target connected PLCs and industrial controllers.
• Enlist industrial compute assets into distributed denial-of-service (DDoS) botnets.

This activity fits into a broader trend of threat actors aggressively probing exposed industrial equipment. Recent cyber operations targeting water utility systems in North America and European industrial refrigeration systems underscore the real-world risk when OT control interfaces are left internet-accessible.

Remediation and Defense Guidance

Organizations operating industrial gateways, edge devices, or server infrastructure running Node-RED should take immediate steps to secure their deployments:

1. Disable Public Internet Access: Node-RED management interfaces must never be exposed directly to the public internet. Restrict interface access to local management VLANs or require access via a secure Virtual Private Network (VPN) with multi-factor authentication.
2. Enable Node-RED Admin Authentication: Review Node-RED configuration files (settings.js) and ensure administrative security settings (adminAuth) are explicitly enabled with strong, unique credentials or integrated with an enterprise identity provider.
3. Apply Firmware and Software Updates: Apply vendor-provided patches and updated system images for affected hardware, including Siemens SIMATIC IoT2050 devices, to ensure default non-authenticated states are eliminated.
4. Inspect HTTP Logs for Indicators of Compromise: Search reverse proxy, web server, and application logs for suspicious POST /flows requests originating from untrusted remote IPs, specifically inspecting for payload strings containing shell commands (curl, wget, chmod +x, or references to bot-linux-amd64).
5. Block Threat Infrastructure: Configure edge firewalls and intrusion prevention systems (IPS) to block incoming and outgoing connections to known attacker infrastructure (4.201.105[.]116 and 85.215.73[.]250).