Researchers report active exploitation of maximum-severity Node-RED flaw
VulnCheck says an attacker used the industrial automation tool to push a flow that downloads and runs a Linux bot
Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot, according to the security firm VulnCheck. The vulnerability, tracked as CVE-2026-58115, carries a CVSS rating of 10 out of 10 and affects Siemens devices that do not enforce authentication on the Node-RED HTTP interface.