CVE-2026-58115

What it is. Siemens SSA-834709 says SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED, before V4.3.4.1, "do not enforce authentication on the Node-RED HTTP interface." Anyone who can reach that interface can deploy a flow, and a flow can run system commands. Siemens' advisory has one revision, dated August 11, 2026, and no credit section.

What VulnCheck saw. VulnCheck's November 2 report (Patrick Garrity) says the attack was a single POST /flows request. The payload fetched bot-linux-amd64, which VulnCheck did not retrieve, so it names no malware family. An update dated November 1 describes a staged script (wget.sh), a payload named .kworker, and persistent webshells that run commands through an http in endpoint and an exec node. The same source IP logged 125 hits against 8 CVEs on VulnCheck's canaries.

Other products. VulnCheck notes that Emerson's documentation highlights Node-RED but says "we haven't validated whether their products are impacted by this vulnerability." No other vendor has published an advisory for this CVE.

The test. Two conditions decide exposure.

1. Is the device below V4.3.4.1? Compare the Industrial OS version on each SIMATIC IoT2050 Advanced against V4.3.4.1. At or above it, this CVE is closed.
2. Is Node-RED installed and reachable? Siemens' advisory applies only where Node-RED is installed. From another host on the networks that can reach the device, open the Node-RED editor. If it loads and lets you deploy without a login prompt, the device is exposed. If the editor isn't reachable from any untrusted network, the exposure is limited to hosts that can reach it.

Any Node-RED, not just Siemens. Node-RED's documentation says that by default the editor "is not secured" and the default setup "is only suitable if you are running on a trusted network." The same open-editor check applies to Node-RED on any device or server; an instance without adminAuth configured can be driven the same way, whether or not this CVE applies to it.

These reduce exposure on devices that can't be updated yet, and each works only under the condition at the end of its line.

• Delivery. Block access to the Node-RED interface from untrusted networks. Siemens' general recommendation is that it "strongly recommends to protect network access to devices with appropriate mechanisms." This only helps if no remote users or systems need to reach the editor or its HTTP endpoints.
• Exploitation. Uninstall Node-RED, which Siemens lists as a mitigation, only if nothing on the device depends on its flows.
• Exploitation. Harden Node-RED per its security guide, which Siemens also lists: configure adminAuth in settings.js so the editor and admin API require a login, and httpNodeAuth to protect routes exposed by HTTP In nodes. Node-RED stores those passwords as bcrypt hashes. This only helps if the editor then prompts for a login when you test it.

Updating to V4.3.4.1 or later is the only fix.

From VulnCheck's November 2 report. VulnCheck gives no file hashes.

• Unauthenticated POST /flows requests to the Node-RED interface.
• Deployed flows you didn't create, especially ones with exec nodes or new http in endpoints. VulnCheck advises reviewing flows for both.
• Source IP 4.201.105.116 (AS8075).
• Payload servers 85.215.73.250 (port 8080, serving bot-linux-amd64 and wget.sh) and 45.194.90.57 (port 38472, serving .sys_update).
• Files at /dev/shm/.b, /tmp/.s or /tmp/.kworker on the device.

Am I exposed to CVE-2026-58115?

Yes, if you run a SIMATIC IoT2050 Advanced with Industrial OS below V4.3.4.1 and Node-RED installed, and its Node-RED interface is reachable. Update to V4.3.4.1 or later.

Is CVE-2026-58115 being exploited?

VulnCheck reports: "On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot." It reads the activity as opportunistic mass scanning and lists the CVE in its own KEV catalog. It is not on CISA's KEV, and Siemens' advisory says nothing about exploitation, so the status here is Reported, unconfirmed.

Is there a public exploit?

Not that we found. VulnCheck says it gave its Initial Access customers a proof of concept and detection rules on October 27, 2026; those are not public.

I don't own an IoT2050. Does this matter?

Only if you run Node-RED elsewhere without authentication. Node-RED's editor isn't secured by default, so check any Node-RED instance for adminAuth. VulnCheck says it hasn't validated whether other vendors' Node-RED products, such as Emerson's, are affected by this CVE.

Was a device compromised if it was exposed?

Check its deployed flows for ones you didn't create, especially exec nodes and http in endpoints, and look for VulnCheck's file paths and payload servers under "What to look for in logs." VulnCheck says of the flow-based webshell: "This backdoor survives even if a memory-backed implant is lost on reboot." It also advises: "review deployed flows for unexpected exec nodes or HTTP endpoints." Neither Siemens nor VulnCheck has published compromise checks beyond these and the listed indicators.

Nov 3, 2026. First published. VulnCheck reports canary exploitation from Oct 30; not on CISA KEV.

• Siemens SSA-834709 (Aug 11, 2026)
• NIST NVD: CVE-2026-58115 (Awaiting Analysis; Siemens' 10.0 only, checked Nov 3)
• VulnCheck, Exploitation Targeting Node-RED (Nov 2, 2026)
• Node-RED documentation, Securing Node-RED
• CISA Known Exploited Vulnerabilities catalog (checked Nov 3)