Critical Node-RED Flaw Exploited in Attacks – SecurityWeek

Critical Node-RED Flaw Exploited in Attacks  SecurityWeek

Hackers are exploiting CVE-2026-58115, a critical-severity Node-RED vulnerability, to deploy various payloads. Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells. Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports. Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices. Tracked as CVE-2026-58115 (CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.

Siemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole. According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.” On Sunday, VulnCheck warned that it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit. “It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all