# Node-RED: exploitation attempts observed against unauthenticated interfaces Canonical: https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115 Publisher: Oktsec Language: en Published: 2026-11-03T17:00:17Z Updated: 2026-11-03T17:00:17Z Record reviewed: 2026-11-03T17:00:17Z Latest evidence check: 2026-11-03T17:00:17Z Disclosed: 2026-08-11 VulnCheck observed malicious flow deployments against Node-RED canaries. CVE-2026-58115 covers a specific Siemens configuration; the observations do not establish compromised industrial sites. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Canary telemetry shows automated attempts against unauthenticated Node-RED administration. Prioritize exposed interfaces; no industrial victim is established. - Evidence: Attack attempts observed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Siemens - Products: SIMATIC IoT2050 Advanced with Industrial OS and Node-RED - CVEs: CVE-2026-58115 ## Technical overview Siemens identifies SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed. Missing authentication can allow remote command execution with maximum privileges. VulnCheck reports attempts observed October 30–November 1, including downloader flows and HTTP endpoints connected to command execution. Its canaries simulated vulnerable responses; neither industrial victims nor the downloaded payload’s capabilities are established. Hosting infrastructure does not identify the attacker. Node-RED’s own guide says its editor is unsecured by default and suitable only for trusted networks in that state. This broader configuration risk is not a claim that every Node-RED product falls under the Siemens CVE. ## Recommended response Restrict exposed administration interfaces, enforce authentication and apply the Siemens correction where applicable. Relevant to: Teams responsible for the affected deployments. ## CVE attribution - CVE-2026-58115: Siemens — SIMATIC IoT2050 Advanced. [Source](https://cert-portal.siemens.com/productcert/html/ssa-834709.html) ## Affected systems and fixes ### SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) Affected: Before V4.3.4.1, running Industrial OS with Node-RED installed. Fixed release / action: V4.3.4.1 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.29 Checked: 2026-10-30T10:27:08.428Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-58115 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Identify the product and exposure** — Inventory the Siemens model, Industrial OS version and Node-RED installation. Review other deployments under their own vendor guidance. 2. **Protect the administration interface** — Restrict network reachability and configure adminAuth. Verify unauthenticated users cannot deploy flows; HTTPS alone is not authentication. 3. **Apply the Siemens correction** — Upgrade affected SIMATIC IoT2050 Advanced devices to V4.3.4.1 or later. Siemens also lists removal or hardening of Node-RED as mitigations. 4. **Review deployed flows** — Investigate unexpected exec nodes and HTTP endpoints. Preserve evidence and coordinate containment with the OT owner before disrupting operations. ## Relevance to AI environments Include automated workflows in the response inventory; the evidence does not establish AI involvement in the attack. ## Sources - [Siemens SSA-834709: affected product and correction](https://cert-portal.siemens.com/productcert/html/ssa-834709.html) — Siemens; Vendor notice; checked 2026-11-03T17:00:17Z - [Node-RED exploitation attempts in canary telemetry](https://www.vulncheck.com/blog/exploitation-targeting-node-red) — VulnCheck; Research report; checked 2026-11-03T17:00:17Z - [Secure the Node-RED editor and admin API](https://nodered.org/docs/user-guide/runtime/securing-node-red) — Node-RED; Vendor notice; checked 2026-11-03T17:00:17Z ## Editorial record - 2026-11-03T17:00:17Z: Added source scope and a practical response checklist. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115) · [Build a response plan](https://www.oktsec.com/radar/siemens-node-red-cve-2026-58115#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=siemens-node-red-cve-2026-58115&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=siemens-node-red-cve-2026-58115&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.