Attackers are exploiting a maximum-severity vulnerability in Node-RED, the flow-based programming tool widely used in industrial control and operational technology environments, to download and run a Linux bot. Researchers at VulnCheck said one of their canary systems caught the exploitation on October 30, 2026, and they warned about it in an advisory on Monday, November 2.
The flaw is tracked as CVE-2026-58115. Siemens assigned the identifier in August and gave the bug a perfect 10-out-of-10 CVSS score. Affected Siemens devices, including products in the SIMATIC IoT2050 line, do not enforce authentication on the Node-RED HTTP interface. That allows an unauthenticated remote attacker to reach programming nodes that can execute system commands on the device.
The exploitation method is simple, which is part of the danger. VulnCheck researcher Patrick Garrity said two built-in Node-RED nodes make the vulnerability trivial to weaponize. An inject node fires a message on a schedule or once at startup, and an exec node can run shell commands. Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction needed.
In the case VulnCheck observed, the attacker sent the complete exploit, flow and dropper in a single POST to the /flows endpoint. The researchers did not retrieve the binary itself, so they cannot say exactly what it does once running. Its filename, bot-linux-amd64, indicates the malware targets Linux systems running on AMD64 processors, and suggests the operator may have other builds for other architectures.
The activity came from a single IP address in Microsoft's AS8075 network that geolocates to Brazil. Between October 30 and November 1, VulnCheck saw that address target the same Node-RED vulnerability 16 times, while logging 125 hits against eight different CVEs across its wider canary network. One hit delivered a different payload pointing to a separate server, a pattern Garrity described as a likely scan-and-infect arrangement, with hosts that find vulnerable systems pulling the implant from a dedicated download server.
Because the same scanning also probed unrelated older flaws, including a seven-year-old Apache Solr vulnerability tracked as CVE-2019-17558, the researchers believe this is opportunistic mass scanning rather than a targeted campaign against one organization. That distinction matters less than the exposure itself: any internet-reachable Node-RED instance in an OT environment is a candidate.
The incident lands as criminals increasingly target internet-exposed OT and industrial control devices, where a compromise can affect physical processes. VulnCheck has added the flaw to its own Known Exploited Vulnerabilities catalog, though it had not yet appeared in the U.S. Cybersecurity and Infrastructure Security Agency's KEV catalog at press time.
For defenders, the immediate steps are straightforward. Check today whether any Node-RED instance, including those inside OT environments, is reachable from outside the network. Apply updates where available, restrict access to the interface, require authentication, and add detections for unexpected flows and outbound downloads. A tool designed to automate workflows should never be left open to anyone who can find it.