Critical Node-RED Flaw Exploited in Attacks

Hi, what are you looking for?

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Hackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.Tracked asCVE-2026-58115(CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.Siemensdisclosedit on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Node-RED is a low-code, flow-based programming tool that supports the creation of event-driven applications through a browser-based editor. It is used in products across various sectors, including commercial ICS/OT devices.Tracked asCVE-2026-58115(CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.Siemensdisclosedit on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Tracked asCVE-2026-58115(CVSS score of 10/10), the bug is described as a missing authentication issue on the Node-RED HTTP interface that could enable attackers to access programming nodes that can execute system commands.Siemensdisclosedit on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Siemensdisclosedit on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches for the security hole.According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

According to Siemens, CVE-2026-58115 “could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.”On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

On Sunday, VulnCheckwarnedthat it had observed successful in-the-wild exploitation of the vulnerability on October 30. The attack came from an IP in AS8075, Microsoft’s network, and delivered a complete exploit.Advertisement. Scroll to continue reading.“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

“It deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding,” VulnCheck says.The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

The payload was a Linux bot, and the execution command did not check if the installation succeeded. Based on the file’s name, the company believes the attackers had built payloads for multiple architectures.By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

By November 1, VulnCheck observed 15 additional attacks from the same IP address, delivering additional payloads, including persistent webshells that would allow the hackers to run arbitrary commands on the compromised servers.According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

According to the company, the attacks show that threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically with a single HTTP request.“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

“If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today. Also review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots,” VulnCheck notes.Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressRelated:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Related:Drupal Commerce Core Vulnerability Exploited Against Online Stores

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.