Attackers exploit critical Node-RED flaw CVE-2026-58115 from single IP

VulnCheck reported active in-the-wild exploitation of critical Node-RED flaw CVE-2026-58115 starting Oct. 30, 2026, from a single source IP address, 4.201.105.116, in Microsoft’s AS8075 network geolocating to Brazil.

CVE-2026-58115 is a missing-authentication flaw in the Node-RED HTTP interface with a CVSS score of 10.0. An unauthenticated remote attacker can create malicious flows and run arbitrary code on the underlying server with the highest privileges. {

Siemens said the flaw “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.” The file name suggests the operators built payloads for multiple architectures.

The attacker sent one HTTP POST to the /flows endpoint that deployed and automatically triggered a Node-RED flow. The flow downloaded a binary from an attacker-controlled server using three layers of encoding.

The initial payload was a Linux bot named bot-linux-amd64, saved as /dev/shm/.b in memory and executed in the background. The download command used wget with a curl fallback and did not verify whether installation succeeded.

Between Oct. 30 and Nov. 1, 2026, the same IP address conducted 16 attacks against this vulnerability, delivering additional payloads. Later attacks installed persistent webshells through HTTP in endpoints such as /cmd, wired to exec nodes, allowing arbitrary commands via query parameters and surviving reboots.

Attacks automatically find and exploit Node-RED instances that lack adminAuth, and a single HTTP request can deploy the exploit. Node-RED provides a flow-based programming environment built on Node.js with a browser-based editor, serving manufacturing, healthcare, home automation and commercial ICS/OT products. {

Affected commercial ICS/OT products include Siemens SIMATIC IoT2050 Advanced running Industrial OS with Node-RED. Siemens disclosed the flaw on Aug. 11, 2026, and patched the affected SIMATIC IoT2050 Advanced Industrial OS in version V4.3.4.1 and later. Versions of SIMATIC IoT2050 Advanced before V4.3.4.1 are vulnerable.

The affected Siemens model is SIMATIC IoT2050 Advanced model 6ES7647-0BA00-1YA2. The attack required no credentials, prior access, or user interaction, only network access to the exposed HTTP interface. CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. IONIX identifies potentially affected assets by matching the raw HTTP response body identifier red-ui-editor.

The malicious Node-RED flow combined an empty tab, a one-shot inject node carrying a one-second delay, and an exec node. The attacker’s request used curl/8.5.0, and the attacker sent it as one HTTP POST to the /flows endpoint. VulnCheck’s canary sent back an HTTP 200 reply and a fresh flow revision hash just like a real vulnerable instance, which caused the signature to mark the event as a successful exploit.

The base64-encoded dropper hides wget and curl commands from naive filters that scan request bodies for those strings. The file at /dev/shm/.b lives in RAM-backed tmpfs; the system never writes it to disk, it stays hidden from plain ls because of its leading dot, and it vanishes on reboot unless the bot creates persistence another way. The attacker uses setsid to start the binary in its own session so it survives after the Node-RED process ends, with nohup as a backup, and throws away all output.

Server 85.215.73.250 on port 8080 served a second-stage script named wget.sh. VulnCheck’s Initial Access team released detection tools on Oct. 27, 2026, including an exploit proof of concept, a version scanner, packet captures, Suricata, Snort and YARA rules, a Docker container, and search engine queries for Shodan, Censys, GreyNoise, FOFA and ZoomEye.

The same source IP logged 125 hits against eight other CVEs over recent days, including Apache Solr CVE-2019-17558, Camunda, Gitea, MLflow, Traefik and Joomla. Emerson’s documentation highlights its use of Node-RED, though VulnCheck has not confirmed whether their products are exposed to this flaw. VulnCheck dated its analysis to Oct. 30, 2026 based on canary telemetry and later reviewed further events on Nov. 1, 2026.

VulnCheck did not retrieve the bot binary or scripts, so their exact capabilities remain unknown. VulnCheck placed the flaw in its KEV catalog after spotting the in-the-wild attempt, while CISA had not added it to its own KEV catalog yet. {

Researchers saw at least five user agents in the Node-RED attacks, including curl, python-requests, Python-urllib and browser strings, plus several payloads, pointing to shared or rented infrastructure used by multiple operators. The payload server 85.215.73.250 serves the binary from port 8080, and VulnCheck never observed this server directly, suggesting a scan-and-infect setup where exploit hosts pull implants from a separate dedicated server.

Patrick Garrity said, “This backdoor survives even if a memory-backed implant is lost on reboot.” Siemens advises enabling HTTPS, protecting the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and securing HTTP Nodes and the Node-RED Dashboard with basic authentication.

Security researchers cite internet scan data showing that over 20,000 Node-RED management interfaces remain exposed on the public internet. When these programming interfaces face the internet, attackers can directly compromise vital operational technology networks. Defenders should keep administrative ports such as port 1880 off the public internet and host management consoles behind internal firewalls, virtual private networks or reverse proxies that use multifactor authentication.

No standalone public proof-of-concept exploit tools have been released by researchers as of Nov. 2, 2026. EPSS score is 0.7% over 30 days. {

Defenders should check whether Node-RED is reachable from outside the network. Defenders should apply updates, restrict remote access, and inspect deployed flows for unauthorized execution nodes or web endpoints. {

Siemens recommends updating to V4.3.4.1 or later, uninstalling Node-RED if unneeded, enabling adminAuth, using HTTPS, and blocking external access to port 1880.

A device is not affected if it does not have Node-RED installed. Siemens hardening guidance tells administrators to create the admin password hash using the node-red admin hash-pw command. Any Node-RED deployment lacking adminAuth faces the same exploitation method regardless of vendor, but Beacon Lab says this does not mean other products carry CVE-2026-58115. Defenders should check for unfamiliar flows containing exec or function nodes, unauthorized http in nodes, hidden files under /dev/shm and /tmp, Node-RED-spawned processes, and connections to indicator IP addresses.