TL;DR · 30-second read
The Short Version
Criminals are breaking into small industrial computers, the boxes that link factory and building equipment to a network, through a flaw rated 10 out of 10 for severity. It sits in Node-RED, a popular tool for programming those boxes. On some Siemens devices, that tool accepts commands from anyone, with no password required.
Researchers watched one attacker try it 16 times in three days. The same attacker also went after software that companies use to manage artificial-intelligence projects. The lesson is simple: automated attacks sweep the internet without caring what a machine controls. Equipment that runs cooling or water systems gets hit just like any website.
Attackers are actively exploiting CVE-2026-58115, a vulnerability with a maximum 10.0 severity score in Node-RED as shipped on Siemens SIMATIC IoT2050 industrial gateways. They use it to deploy a flow that downloads and runs a Linux bot, The Register reported on November 2, 2026. Siemens assigned the identifier in August. The affected devices do not require authentication (a login check) on Node-RED’s web interface, so anyone who can reach it can create programs that run system commands.
VulnCheck researcher Patrick Garrity said a company canary (a decoy system built to attract attackers) caught the exploit on October 30. Between October 30 and November 1, a single IP address tried the Node-RED flaw 16 times and logged 125 hits against eight different vulnerabilities across VulnCheck’s decoys. VulnCheck has added the bug to its Known Exploited Vulnerabilities catalog. As of press time it was not on the US Cybersecurity and Infrastructure Security Agency’s equivalent list.
Executive Summary
The vulnerability is simple to use. Node-RED lets engineers build automation by wiring together nodes, which are prebuilt functional blocks. Two of its built-in nodes do most of the work for an attacker. An inject node fires a message at startup or on a schedule, and an exec node runs shell commands on the device. “Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity said. The observed attacker sent the complete exploit, flow and dropper in a single web request.
The pattern of the activity matters as much as the bug. The same source hit a seven-year-old Apache Solr flaw and vulnerabilities in unrelated products including Camunda, Gitea, MLflow, Traefik and Joomla. VulnCheck read that mix as opportunistic mass scanning rather than a targeted operation. For anyone running facility controls, the implication is direct. An exposed industrial gateway is treated the same as any exposed web application: it gets found, tried and enrolled automatically.
A Programming Tool With No Front Door
Node-RED is a flow-based programming tool built on Node.js, a widely used JavaScript runtime. It is common in industrial control systems (ICS) and operational technology (OT), the hardware and software that run physical processes rather than business data. Its appeal is that engineers can connect sensors, controllers and cloud services by drawing flows in a browser instead of writing code. That same convenience becomes the danger when the browser interface does not check who is using it.
On the affected Siemens devices, the Node-RED HTTP interface does not enforce authentication. Anyone who can reach it can deploy a flow, and a flow can include an exec node that runs operating-system commands. This is not a memory-corruption bug that needs a skilled exploit. The attacker uses the product’s normal programming features to do exactly what they were designed to do. Garrity called the flaw “trivial to weaponize” for that reason, and it is the main reason the 10-out-of-10 rating holds up in practice as well as on paper.
Why the Scan List Matters More Than the Attacker
Over roughly three days, VulnCheck’s decoys logged 125 hits against eight different CVEs from one IP address, and 16 of those hits targeted the Node-RED bug. The rest went after a mix of old and new flaws in software with nothing in common functionally. The list included a 2019 Apache Solr vulnerability, a code-hosting tool (Gitea), a workflow engine (Camunda), a reverse proxy (Traefik), a content management system (Joomla) and MLflow, an open-source platform teams use to track machine-learning experiments and manage models. An industrial gateway sat in the same rotation as a machine-learning server and a blog engine.
That is the operational conclusion. The scanner does not distinguish between an IT asset and an OT asset, or between an AI development box and a gateway connected to physical equipment. It checks for reachable, vulnerable services and fires. Many operators still treat OT exposure as a niche risk that only sophisticated, targeted attackers would exploit. This activity points the other way. Once a flaw this easy to use is added to a commodity toolkit, any internet-reachable instance faces the same automated pressure as a forgotten web app. That includes gateways in plants, utilities, and the building, power and cooling systems of facilities such as data centers.
The infrastructure behind the activity reinforces this reading. One exploit attempt pointed to a separate download server. Garrity said this suggests a scan-and-infect setup: the hosts that find and exploit targets pull the implant from a dedicated machine. The payload filename, bot-linux-amd64, implies a build for standard 64-bit Linux and suggests the operator may have builds for other platforms. That is how botnet operators work when they aim to recruit large numbers of devices, not to sabotage one site.
From Gateway to Physical Plant
The likely aim here is botnet recruitment. Even so, the device being recruited sits next to physical processes. An edge gateway that runs Node-RED usually exists to move data and commands between controllers and other systems. A bot with shell access on that box sits one hop from equipment that controls temperatures, pumps or power. The activity also arrives against the backdrop of the ongoing refrigeration-controller intrusions across Europe and this summer’s attacks on water systems in at least 12 US states. These are reminders that attacks on OT can produce physical effects.
For operators of data centers and other critical facilities, the relevant asset class is often the least inventoried one. It includes gateways and engineering tools that integrators install for monitoring or automation, which may never appear in the IT team’s patch cycle. VulnCheck could not say what the bot does once it runs, because researchers did not retrieve the binary. That uncertainty argues for caution. A device whose behavior after compromise is unknown, sitting beside control systems, is a risk to remove quickly.
What Defenders Can Act On Now
Garrity’s advice was blunt. Anyone running Node-RED anywhere, including inside OT environments, should check today whether it is reachable from outside the network, apply updates where available, and put detections in place. The observed indicators can feed blocklists and hunting queries: the exploiting address 4.201.105[.]116, which sits in Microsoft’s AS8075 network and geolocates to Brazil, the separate payload host 85.215.73[.]250, and requests to the /flows endpoint that create flows pairing inject and exec nodes. The addresses are written with brackets so they cannot be clicked by accident.
The gap between catalogs also matters for compliance-driven teams. Many organizations prioritize patching by CISA’s Known Exploited Vulnerabilities list. At press time, this bug appeared in VulnCheck’s catalog but not CISA’s, so a process that waits for the government list would not yet flag it.
Background
Operational technology (OT) is the hardware and software that monitors and controls physical equipment, such as pumps, chillers, power distribution and production lines. It has traditionally been isolated from the internet. Edge gateways such as Siemens’ SIMATIC IoT2050 connect that equipment to IT networks and cloud services, and many run Node-RED so engineers can build integrations quickly. That connectivity has made OT devices visible to the same automated scanning that has long targeted web servers.
Known Exploited Vulnerabilities (KEV) catalogs list flaws confirmed to be under active attack. Security teams use them to decide what to patch first. CISA maintains the US government’s KEV list, which is binding on federal agencies and widely used as a benchmark by private companies. Commercial threat-intelligence firms such as VulnCheck maintain their own catalogs, which sometimes list a vulnerability before CISA does. Source: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware. The Register reports on active exploitation of CVE-2026-58115 in Node-RED on Siemens industrial gateways, as documented by VulnCheck.Sources