Security AlertCritical
Node-RED flaw is being exploited to plant bots and webshells
Nov 3, 2026 · Summarized by Fundy Tech from SecurityWeek
The 30-second version
Hackers are exploiting a critical Node-RED flaw to deploy Linux bots and webshells. VulnCheck says attacks came from the same IP address and used one HTTP request.
Key points
- The flaw is CVE-2026-58115, scored 10/10.
- Siemens says affected SIMATIC IoT2050 devices need version 4.3.4.1 or later.
- VulnCheck saw at least 15 follow-up attacks by November 1.
Why it matters
If Node-RED is exposed to the internet, attackers may be able to take control fast. That can affect industrial systems, building controls and other connected equipment used by businesses.
Who’s affected: Exposed Node-RED instances, including ICS/OT devices
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.