critical severityConfidence highHistorical record

Node-RED editors with no login are being hijacked to run a Linux bot and webshells (CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced)

Direct answer

Node-RED editors with no login are being hijacked to run a Linux bot and webshells (CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced), also tracked as CVE-2026-58115 / SSA-834709 / ICSA-26-237-03 is a critical-severity threat campaign HOL Guard tracked from Aug 11, 2026 to Nov 1, 2026, verified against 8 primary sources and last reviewed Nov 3, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-58115 (CVSS v3.1 10.0 and CVSS v4.0 10.0, CWE-306) was published by Siemens ProductCERT on 2026-08-11 in SSA-834709 and republished by CISA as ICSA-26-237-03 on 2026-08-25. SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) devices before V4.3.4.1 running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, so an unauthenticated remote attacker can create flows with nodes that execute system commands, with maximum privileges. The root cause is the Node-RED default: the editor and admin API are unsecured unless adminAuth is configured, so any Node-RED instance reachable without adminAuth accepts the same request. VulnCheck reported in-the-wild exploitation caught by a canary on 2026-10-30: a single POST /flows deploying an inject node wired to an exec node that downloads bot-linux-amd64 to /dev/shm/.b and runs it, followed by 16 events from the same AS8075 source through 2026-11-01 including a staged script, a second payload server, and http-in webshell flows. VulnCheck added the CVE to its own KEV; it is not on CISA KEV as of catalog 2026.10.30.

Also tracked as CVE-2026-58115 · SSA-834709 · ICSA-26-237-03 · Node-RED adminAuth missing · Node-RED unauthenticated POST /flows · Siemens IoT2050 Node-RED missing authentication

First observed
Aug 11, 2026
Last observed
Nov 1, 2026
Last reviewed
Nov 3, 2026
Tracking ended
Nov 1, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

VulnCheck's events come from one source IP and VulnCheck did not retrieve the bot binary or staged scripts, so their function is unknown. Siemens does not describe what changes in Industrial OS V4.3.4.1. Exposure counts of internet-reachable Node-RED instances without adminAuth are not published in the primary sources. The observation that the published POST /flows body replaces the existing flow set is HOL's reading of the Node-RED admin API documentation (full deployment by default, rev omitted forces deploy), not a statement from VulnCheck.

  • SIMATIC IoT2050 Advanced devices without Node-RED installed are outside the Siemens advisory.
  • Node-RED instances with adminAuth configured and no write-capable default user reject unauthenticated POST /flows (flows.write required).
  • Instances bound to 127.0.0.1 are not reachable by network scanners, though local processes can still reach them.
  • Only the IoT2050 Advanced article number 6ES7647-0BA00-1YA2 is listed by Siemens; other products embedding Node-RED are not assessed in the advisory.
  • Excluding the exec node via nodesExcludes is defence in depth only; without adminAuth the admin API can still install palette modules through POST /nodes unless externalModules.palette.allowInstall is false.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not sit in front of Node-RED or ICS gateways; the fix is the Siemens update or Node-RED adminAuth plus network restriction.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    Siemens ProductCERT publishes SSA-834709 for CVE-2026-58115 (CVSS 10.0, CWE-306) with fix V4.3.4.1 and mitigations uninstall or harden Node-RED.

    Source:Siemens ProductCERT SSA-834709

  2. Disclosure

    CISA republishes the Siemens advisory as ICSA-26-237-03.

    Source:CISA ICSA-26-237-03 Siemens SIMATIC IoT2050 Advanced

  3. Update

    VulnCheck publishes detection artifacts for CVE-2026-58115 for its Initial Access customers.

    Source:VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products

  4. First observed

    VulnCheck canary records a successful exploit: single POST /flows deploying inject plus exec nodes that download and run bot-linux-amd64.

    Source:VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products

  5. Update

    VulnCheck reports 16 events from the same source IP, additional droppers and http-in webshell flows; CVE added to VulnCheck KEV, not CISA KEV.

    Source:VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products

  6. Update

    HOL Guard publishes an operator write-up with the /auth/login check, adminAuth and uiHost hardening, the flows review command and scope notes.

    Source:HOL: Node-RED editors with no login exploited (CVE-2026-58115), fix and check

Publication clock: 2034.2 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) with Node-RED installed@< V4.3.4.1 (Industrial OS)genericpackage
  • Node-RED settings.js without adminAuth (default)npmconfig

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

  • urlmedium confidencedefanged
    hxxp://85.215.73[.]250:8080/bot-linux-amd64
  • urlmedium confidencedefanged
    hxxp://85.215.73[.]250:8080/wget.sh
  • urlmedium confidencedefanged
    hxxp://45.194.90[.]57:38472/.sys_update

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

CVE-2026-58115 (CVSS 1 HOL Guard tracked the campaign from Aug 11, 2026 to Nov 1, 2026.

No. Active tracking ended Nov 1, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 8 primary sources, names 2 reviewed artifacts, and was last fully reviewed Nov 3, 2026 by HOL Guard Security Publishing. Its 3 indicators are published defanged, as inert text that cannot be followed or executed. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. VulnCheck's events come from one source IP and VulnCheck did not retrieve the bot binary or staged scripts, so their function is unknown. Siemens does not describe what changes in Industrial OS V4.3.4.1.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-B0E825AE