[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG_0EMDM_bVtT9vBVZjwDvaH_A9-N3zv3J2S-YF5spTA":3},{"article":4,"iocs":53,"watch_terms":62,"solutions":63,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"002b2e41-6137-4a0a-a12c-14a3f74b0843","Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)","attackers-exploit-critical-node-red-flaw-to-deploy-linux-bot-and-backdoors-cve-2-7dbe7b","Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprotected servers, VulnCheck has found. Node-RED is a flow-based programming tool built on Node.js that lets users wire together event-driven applications in a browser-based editor. It can run on small devices such as the Raspberry Pi or in the cloud, and it is used in manufacturing, healthcare, and home … More → The post Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) appeared first on Help Net Security.","Attackers are actively exploiting a critical authentication flaw (CVE-2026-58115) in Node-RED, a programming tool used in industrial control systems and other environments. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with maximum privileges, leading to the deployment of Linux bots and backdoors on affected servers. VulnCheck observed exploitation attempts that downloaded malicious binaries and installed webshells for persistent access.","Attackers exploit critical Node-RED flaw CVE-2026-58115 to deploy Linux bots and backdoors.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F03\u002Fnode-red-cve-2026-58115-exploitation\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F03134721\u002Fnode-red-1500.webp","2026-11-03T12:59:51+00:00","2026-11-03T14:00:17.593413+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Node-RED","product",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":19},"SIMATIC IoT2050 Advanced",{"name":26,"type":22},"Microsoft",{"name":28,"type":29},"Linux","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"cve","CVE-2026-58115","Critical authentication flaw in Node-RED",{"type":59,"value":60,"context":61},"ip","104.168.130.10","IP address observed exploiting CVE-2026-58115, geolocates to Brazil",[26,21,18],{"controls":64,"vendors":151},[65,94,122],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":116,"vendor_name":26,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":123,"name":124,"problem":125,"products":126},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[152],{"slug":153,"name":21,"logo_path":154,"roles":155},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"critical-node-red-auth-bypass-exploited-to-deploy-linux-bots-and-backdoors","Critical Node-RED Auth Bypass Exploited to Deploy Linux Bots and Backdoors","A critical unauthenticated remote code execution vulnerability (CVE-2026-58115) in Node-RED is being actively exploited to deploy Linux bots, backdoors, and webshells on affected servers. The flaw allows attackers to gain maximum privileges without any credentials, making it trivially exploitable once a system is exposed. Node-RED is commonly deployed in industrial control and IoT environments, where patch cycles are often slower and consequences of compromise are severe. This incident underscores how unpatched internet-facing services become immediate targets once a critical CVE is published, and how delayed remediation creates windows of opportunity that threat actors exploit within days.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"CIS Control 17: Incident Response Management":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 mandates incident handling and vulnerability management practices for operators of essential services; industrial environments using Node-RED fall within scope and must maintain patched, hardened systems.","SI-2 requires organisations to identify, report, and correct information system flaws; adherence would have mandated timely patching of the critical Node-RED authentication bypass.","Detection of deployed webshells and Linux bots requires a mature incident response capability; without predefined playbooks for webshell detection and containment, dwell time and damage increase significantly.","Node-RED running an unpatched version with a known critical CVE is a direct example of the risk described by A06, where using components with known vulnerabilities leads to full system compromise.","Regular vulnerability scanning and a defined remediation timeline would have identified CVE-2026-58115 and triggered patching before attackers could exploit the window of exposure.","A.8.8 requires organisations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven patch deployment before active exploitation began.","The vulnerability allowed completely unauthenticated access; enforcing strong authentication controls on the Node-RED editor would have neutralised exploitation even before a patch was applied."]