Cybersecurity researchers have identified active exploitation of a critical vulnerability in Node-RED, a popular low-code programming tool used across various industries. This flaw, cataloged as CVE-2026-58115 with a maximum CVSS score of 10, was first disclosed by Siemens after it was discovered in their SIMATIC IoT2050 Advanced devices using Node-RED. The vulnerability arises from missing authentication on the Node-RED HTTP interface, which could potentially allow attackers to manipulate programming nodes to execute arbitrary system commands.

Siemens revealed this issue on August 11 and provided patches for versions 4.3.4.1 and later. However, recent reports from VulnCheck indicate that the vulnerability has been successfully exploited in the wild. On October 30, an attack originating from an IP associated with Microsoft’s network delivered a payload by deploying a Node-RED flow, executing it, and retrieving a binary from a malicious server. This attack utilized complex encoding techniques and involved the deployment of a Linux bot, suggesting that the attackers developed payloads for various architectures.

By November 1, VulnCheck reported observing fifteen additional attacks from the same IP address. These attacks delivered new payloads, including persistent webshells, enabling attackers to execute arbitrary commands on compromised systems. The attacks highlight that threat actors are actively scanning for Node-RED instances without proper authentication and exploiting them with a single HTTP request. VulnCheck recommends that organizations using Node-RED, especially within ICS/OT environments, ensure their systems are not accessible from untrusted networks and review their deployed flows for unexpected elements that could indicate security breaches.