Maximum-severity Node-RED flaw is being exploited to push Linux malware onto industrial devices

Unknown attackers are exploiting CVE-2026-58115, a maximum-severity (10 out of 10) vulnerability in Node-RED, a programming tool widely used for workflow automation in industrial control and operational technology environments. It is also built into commercial products such as the Siemens SIMATIC IoT2050. Siemens assigned the vulnerability identifier in August. Affected Siemens devices do not require authentication on the Node-RED web interface, so a remote attacker can reach programming nodes that run system commands on the device.

VulnCheck researcher Patrick Garrity reported that one of the company's canary systems caught an attacker exploiting the flaw on 30 October 2026. Two built-in nodes make it simple to abuse: one triggers a message on a schedule or at startup, and the other runs shell commands. Linked together, they run a command as soon as the flow is deployed. The attacker sent the full exploit and downloader in a single request. The activity came from one IP address in Microsoft's network that geolocates to Brazil.

Much remains unknown. Researchers did not retrieve the malware, so they cannot say what it does once running. Its filename, bot-linux-amd64, suggests it targets Linux on AMD64 processors, and other versions may exist. The report notes that criminals are increasingly targeting internet-exposed OT devices, citing recent refrigeration controller hacks in Europe and attacks on water systems across at least 12 US states.