“On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115,” VulnCheck researcher Patrick Garrity warned.
VulnCheck capture and the initial alarm
VulnCheck’s telemetry detected a live exploit of a maximum-severity Node-RED flaw on October 30, 2026. The researchers reported that the attacker submitted a complete exploit — a flow and a dropper — in a single POST /flows request, rather than merely scanning. Between October 30 and November 1, the single observed source IP (4.201.105[.]116) targeted the same Node-RED vulnerability 16 times and produced 125 hits against eight different CVEs across VulnCheck’s broader canary network. Those patterns led Garrity and his team to describe the activity as opportunistic mass scanning rather than a narrowly focused campaign.
CVE-2026-58115: Node-RED inject and exec nodes make exploitation trivial
Siemens assigned the identifier CVE-2026-58115 in August and explained the bug’s 10-out-of-10 CVSS rating. Affected devices do not enforce authentication on the Node-RED HTTP interface, which allows unauthenticated remote access to programming nodes that can execute system commands. Garrity explained why that matters: two built-in Node-RED nodes — the inject node, which fires a message on a schedule or at startup, and the exec node, which runs shell commands — can be wired together so that “the flow executes a command as soon as it is deployed, with no further interaction.”
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageObserved attacker infrastructure: 4.201.105[.]116, 85.215.73[.]250 and a likely scan‑and‑infect model
The IPv4 address that submitted the exploit (4.201.105[.]116) sits in Microsoft’s AS8075 network and geolocates to Brazil, according to VulnCheck. In at least one case a payload pointed to a separate download server, 85.215.73[.]250, which VulnCheck now tracks but for which investigators have “no telemetry other than the URL.” Garrity noted that because the download host differs from the host that sent the exploit, “the likely setup is a scan-and-infect arrangement: the hosts that find and exploit vulnerable instances pull the implant from a separate, dedicated server.”
Affected Siemens devices and the Linux implant indicator
Node-RED is a flow-based programming tool built on Node.js and used for workflow automation in ICS and OT environments; it is embedded in commercial products including Siemens SIMATIC IoT2050. Siemens’ advisory highlighted the lack of HTTP authentication on affected devices as the core weakness. VulnCheck did not fetch a binary from the observed incidents, so researchers could not analyze a payload, but the filename used in the attack — bot-linux-amd64 — indicates the implant targets Linux on AMD64 processors and suggests the operator may possess additional builds for other platforms.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: VulnCheck’s recommendation is direct — check whether Node-RED instances are reachable from outside the network, apply updates where available, and implement detections to reduce the risk of exploitation. The detection of a complete POST /flows exploit and repeated hits across eight CVEs underscores the need for network exposure checks and flow-level monitoring.
- Procurement leaders and product owners (Siemens customers): Affected Siemens devices were named in the advisory; Siemens assigned CVE-2026-58115 and explained the authentication failure. Procurement and operations teams should verify firmware and software update status for devices such as SIMATIC IoT2050 and confirm whether vendor mitigations have been applied.
- End users and operators in OT/ICS environments: The activity comes amid a broader trend of criminals targeting internet‑exposed OT and ICS devices, with recent examples cited by the researchers including refrigeration controller compromises in Europe and attacks on water systems across at least 12 US states over the summer. Those precedents underline the potential for cyber intrusions to produce real‑world harm.
VulnCheck has added CVE-2026-58115 to its Known Exploited Vulnerabilities (KEV) catalog, though the bug had not appeared in the US Cybersecurity and Infrastructure Security Agency’s KEV at press time. Garrity emphasized rapid defensive action in a LinkedIn post: “If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation.”
The facts recorded by VulnCheck leave a narrow but consequential set of open questions: the attacker delivered a Linux-targeted filename but researchers “did not fetch the binary, so we can't say what it does once running,” and the observed mix of old and new vulnerabilities across unrelated products supports the assessment of opportunistic mass scanning. Whether operators will find deployed binaries in the wild, and whether the observed infrastructure expands to additional download hosts or builds, will determine whether this remains a probing criminal campaign or escalates into disruptive intrusions.
