CVE-2026-58115
CVSS 10 CRITICAL: a vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). EPSS 1.0% (60th percentile).
Vulnerabilities · 21h ago
VulnCheck logged 16 exploit events from one IP against Node-RED’s unauthenticated admin interface since Oct. 30, 2026, and confirmed a command-running workflow deployed on its canary. CVE-2026-58115 affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed; the canary result does not show that an IoT2050 was compromised.
The flaw lets anyone install a workflow that connects a trigger to a shell-command action. The trigger fires automatically when the workflow is installed, allowing commands to run on the device without another user action. VulnCheck saw the workflow download a Linux bot, but did not retrieve or analyze it, so its capabilities remain unknown.
The same IP also targeted eight CVEs across multiple products, pointing to opportunistic scanning rather than an operation focused on industrial systems. For operators with these devices, Node-RED is a path to command execution; the evidence does not establish whether any IoT2050 was compromised or what the bot can do.
CVSS 10 CRITICAL: a vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). EPSS 1.0% (60th percentile).
1 source covering this story
Exploitation Targeting Node-RED, a Tool Embedded in ICS Products | Blog | VulnCheck
On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot.
Part of the PlainSec briefing for 2026-11-02