Critical Node-RED Flaw Exploited in Attacks
Critical Node-RED vulnerability (CVE-2026-58115) is being actively exploited in attacks.
A critical vulnerability (CVE-2026-58115) in Node-RED, a low-code tool used in various sectors including ICS/OT devices, is being actively exploited. Attackers are leveraging the missing authentication flaw to execute system commands, deploy Linux bots, and install webshells. Siemens has released patches for affected SIMATIC IoT2050 Advanced devices.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Siemens?
Get an email when a new story names Siemens, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical missing authentication flaw in Node-RED (CVE-2026-58115) allowed unauthenticated attackers to execute system commands, deploy Linux bots, and install webshells on affected devices, including Siemens SIMATIC IoT2050 Advanced units used in industrial control environments. The root cause is twofold: the application shipped without enforcing authentication on sensitive endpoints, and organizations failed to apply available patches before active exploitation began. This is particularly dangerous in ICS/OT contexts where compromised devices can bridge IT and operational technology networks, potentially causing physical-world consequences. The incident highlights that low-code platforms with broad system access must be held to the same security standards as any critical infrastructure component.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-58115