Attackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)

Since 30 Oct 2026, automated mass exploitation hits Node-RED instances whose editor/admin API has no authentication (CVE-2026-58115, CVSS 10, assigned by Siemens for SIMATIC IoT2050 Advanced with Industrial OS before V4.3.4.1). One POST /flows deploys an inject+exec flow that downloads and runs a Linux bot from /dev/shm, or plants an HTTP-in endpoint that runs any command. VulnCheck recorded 16 exploit events from one source IP between 30 Oct and 1 Nov, and the same IP also probes Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. Confirmed exposed: VulnCheck canaries. Real victims: unknown. Bot capabilities: unknown, the binary was not analyzed. Any internet-reachable Node-RED without adminAuth is a target, including Node-RED embedded in OT products (Emerson uses Node-RED, impact not validated).

Summary written from the sources below. Check the originals before acting.