Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot, according to the security firm VulnCheck. The vulnerability, tracked as CVE-2026-58115, carries a CVSS rating of 10 out of 10 and affects Siemens devices that do not enforce authentication on the Node-RED HTTP interface.
Node-RED is used for workflow automation in industrial control systems (ICS) and operational technology (OT) environments. It is built on top of Node.js and appears in commercial products including Siemens SIMATIC IoT2050. Siemens assigned the identifier CVE-2026-58115 in August to describe the bug and its perfect severity score: affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands. That means remote attackers without credentials can create malicious flows.
VulnCheck researchers began documenting exploitation last Friday. "On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115," researcher Patrick Garrity warned in a Monday advisory, adding that two Node-RED built-in nodes make the vulnerability "trivial to weaponize." One is an inject node, which fires a message either on a schedule or once at startup; the second, an exec node, can run shell commands. "Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction," Garrity said.
VulnCheck observed activity from a single IP address, 4.201.105[.]116, which sits in Microsoft's AS8075 network and geolocates to Brazil. "It didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows," Garrity wrote. Researchers did not retrieve a binary or staged scripts. The filename, bot-linux-amd64, indicates malware targeting Linux on AMD64 processors and suggests the operator may have other builds. "We did not fetch the binary, so we can't say what it does once running," Garrity noted.
Between October 30 and November 1, the researchers saw the address target the same Node-RED vulnerability 16 times and log 125 hits against eight different CVEs across their wider canary network. Targets included Node-RED and a seven-year-old Apache Solr flaw tracked as CVE-2019-17558, which affects Camunda, Gitea, MLflow, Traefik and Joomla. The mix of old and new bugs across unrelated products indicates "opportunistic mass scanning rather than a targeted attack," according to Garrity. One hit delivered a different payload pointing to a separate server, 85.215.73[.]250, which VulnCheck now tracks but has no telemetry on beyond the URL. "Because the download host is a different machine from the one that sent the exploit, the likely setup is a scan-and-infect arrangement: the hosts that find and exploit vulnerable instances pull the implant from a separate, dedicated server," Garrity wrote.
The bug has been added to VulnCheck's Known Exploited Vulnerabilities catalog but had not appeared in the US Cybersecurity and Infrastructure Security Agency's KEV list as of publication. Garrity's advice to operators: "If you run Node-RED anywhere, including inside OT environments, check today whether it's reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation." He posted that guidance on LinkedIn.
Analysis
Why This Matters
- Node-RED sits in industrial and operational technology settings, so an exploitable flaw there is a route from the internet into environments where compromise can affect physical equipment, not just data.
- The vuln carries the maximum CVSS score of 10, and the tooling needed to abuse it, an inject node wired to an exec node, ships with the product, which lowers the skill barrier for attackers.
- The observed traffic mixed this bug with older flaws in unrelated products, suggesting broad automated scanning of exposed devices rather than a campaign aimed at particular operators.
Background
Node-RED is an open-source, flow-based programming tool built on Node.js, used to wire together devices, services and APIs through a visual editor. Because it connects easily to hardware and industrial protocols, it has been adopted in operational technology and industrial control settings as well as in general automation work. Vulnerabilities in such software are a concern because these systems often run continuously and are sometimes exposed to the internet, and attackers have increasingly looked to target internet-facing operational technology to reach the physical world. Vendors publish severity ratings, known-exploited lists and advisories to help operators judge how urgently to patch.
What to Watch
- Whether the US Cybersecurity and Infrastructure Security Agency adds CVE-2026-58115 to its Known Exploited Vulnerabilities catalog, which would signal a wider response.
- Whether researchers obtain and analyse the bot-linux-amd64 binary, which would clarify what the implant does once running.
- Whether operators of affected Siemens devices and other Node-RED deployments apply updates and remove external reachability to the Node-RED HTTP interface.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedResearchers report active exploitation of a maximum-severity Node-RED vulnerability.www.theregister.com - Articles: “Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot.”
- SupportedVulnCheck says an attacker used Node-RED to push a flow that downloads and runs a Linux bot.www.theregister.com - Articles: “Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot.”
- SupportedThe vulnerability is CVE-2026-58115 and has a CVSS rating of 10 out of 10.www.theregister.com - Articles: “In August, Siemens assigned the vulnerability identifier – CVE-2026-58115 – to describe the bug and explain its perfect 10-out-of-10 CVSS rating.”
- SupportedAffected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands.www.theregister.com - Articles: “Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands on the device.”
- SupportedGarrity said, “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115”.www.theregister.com - Articles: ““On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115,” VulnCheck researcher Patrick Garrity warned in a Monday advisory”
- SupportedGarrity said, “Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction.”www.theregister.com - Articles: ““Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity said.”
- SupportedVulnCheck observed activity from one IP address, 4.201.105[.]116, in Microsoft's AS8075 network, geolocated to Brazil.www.theregister.com - Articles: “The activity observed by VulnCheck came from a single IP address, 4.201.105[.]116, which sits in Microsoft’s AS8075 network and geolocates to Brazil.”
- SupportedGarrity said the IP sent the complete exploit, flow and dropper in a single POST /flows.www.theregister.com - Articles: ““It didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows,” Garrity wrote.”
- SupportedResearchers did not retrieve a binary or staged scripts.www.theregister.com - Articles: “they didn’t retrieve a binary or staged scripts to analyze”
- SupportedBetween October 30 and November 1, the IP targeted the same Node-RED vulnerability 16 times.www.theregister.com - Articles: “Between October 30 and November 1, the researchers saw this IP address target the same Node-RED vulnerability 16 times”
- SupportedResearchers logged 125 hits against eight different CVEs across their wider canary network.www.theregister.com - Articles: “and log 125 hits against eight different CVEs across their wider canary network.”
- SupportedThe vulnerability was in VulnCheck's KEV catalog but not in the US CISA KEV list as of publication.www.theregister.com - Articles: “While the bug has been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog, it hasn’t appeared (as of press time) in the US Cybersecurity and Infrastructure Security Agency’s KEV.”
