Act today Critical Patch available CVSS 10.0
Maximum-severity Node-RED flaw exploited to install Linux malware
The Register - securityNode-RED, Siemens SIMATIC IoT2050 · industrial control systems, critical infrastructureCVE-2026-58115
What happened. Unknown attackers are exploiting CVE-2026-58115 in Node-RED, a programming tool used in industrial systems. Affected Siemens devices do not require login on the web interface, so attackers can create flows that download and run a Linux bot.
Who is affected. Users of Node-RED, including Siemens SIMATIC IoT2050 devices, in industrial control and critical infrastructure settings. The source gives no version numbers.
What to do. Check whether you run Node-RED or SIMATIC IoT2050, apply the Siemens fix, and make sure the Node-RED web interface is not reachable from untrusted networks.
When to act. Act today: the source reports it has been used in attacks
Editor's reading
Forasset ownerOT security leaddetection engineer
- Purdue level
- L3
- L2
Why: Node-RED runs on edge and gateway devices such as the SIMATIC IoT2050 that connect plant data to site systems, placing it at L2 and L3.
- Are you exposed?
Search the asset inventory and network scans for Node-RED instances and SIMATIC IoT2050 devices, and test whether the HTTP interface answers without a login.
- If you cannot fix it yet
- Restrict access to the Node-RED HTTP interface to named engineering hosts using firewall rules.
- Enable authentication on the Node-RED editor and keep it off the internet and corporate network.
- Disable or remove the inject and exec nodes if the site does not need them.
- Watch for
- New or changed Node-RED flows that download files or run system commands, especially using inject and exec nodes.
- Connections to the Node-RED HTTP interface from unknown hosts, and outbound downloads of Linux binaries from the device.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Register - security (opens theregister.com)
More on Node-RED Siemens Critical infrastructure CVE-2026-58115