Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.
Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.
Tracked as CVE-2026-58115 (CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.
Siemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.
According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”
On Sunday, VulnCheck warned that it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.
“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.
The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.
By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.
According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.
“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.
Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
