Attackers exploit maximum-severity Node-RED flaw to deploy Linux bot

Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool used in industrial control and operational technology environments, to deploy a flow that downloads and runs a Linux bot. VulnCheck researchers documented exploitation of CVE-2026-58115 beginning last Friday, and Siemens assigned the identifier in August with a perfect 10 out of 10 CVSS score.

How the flaw is weaponized

Node-RED is built on Node.js and is used in commercial products including Siemens SIMATIC IoT2050. Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands. Two built-in nodes make the vulnerability trivial to weaponize: an inject node that fires a message on a schedule or once at startup, and an exec node that can run shell commands. Wiring one to the other lets the flow execute a command as soon as it is deployed, with no further interaction.

What researchers observed

The activity came from a single IP address, 4.201.105.116, in Microsoft's AS8075 network and geolocating to Brazil. It sent the complete exploit, flow and dropper in a single POST /flows. Between October 30 and November 1, 2026, the same IP targeted the Node-RED flaw 16 times and logged 125 hits against eight different CVEs across VulnCheck's wider canary network.

The targets included a seven-year-old Apache Solr flaw, CVE-2019-17558, affecting Camunda, Gitea, MLflow, Traefik and Joomla, alongside Node-RED. One hit delivered a different payload pointing to a separate server at 85.215.73.250. Because the download host differs from the host that sent the exploit, VulnCheck described a likely scan-and-infect arrangement in which hosts find and exploit vulnerable instances and pull the implant from a separate dedicated server.

Malware and response

Researchers did not retrieve a binary or staged scripts, and they did not fetch the bot binary, so they cannot say what it does once running. Its filename, bot-linux-amd64, indicates that it targets Linux running on AMD64 processors and suggests the operator may have other builds. Garrity advised anyone running Node-RED, including in OT environments, to check whether it is reachable from outside the network, apply updates where available and implement detections. The bug has been added to VulnCheck's Known Exploited Vulnerabilities catalog, but had not appeared in CISA's KEV catalog as of press time.

Sources: The Register