As cited
Copy frozen at (site build).
vulnerabilities
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
Attackers are exploiting CVE-2026-58115, a critical vulnerability in Node-RED that affects industrial control systems and operational technology environments, to deliver a Linux bot. The flaw allows unauthenticated remote code execution on Siemens devices running Node-RED without authentication on the HTTP interface. VulnCheck researchers documented active exploitation beginning October 30, 2026, with a single attacker conducting opportunistic scanning against multiple vulnerabilities across their canary network.
Why it matters: Organizations running Node-RED in OT and ICS environments face immediate risk of unauthorized command execution and malware deployment; practitioners should immediately verify network exposure, apply available updates, and implement detection rules for this maximum-severity vulnerability.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
Attackers are exploiting CVE-2026-58115, a critical vulnerability in Node-RED that affects industrial control systems and operational technology environments, to deliver a Linux bot. The flaw allows unauthenticated remote code execution on Siemens devices running Node-RED without authentication on the HTTP interface. VulnCheck researchers documented active exploitation beginning October 30, 2026, with a single attacker conducting opportunistic scanning against multiple vulnerabilities across their canary network.
Why it matters: Organizations running Node-RED in OT and ICS environments face immediate risk of unauthorized command execution and malware deployment; practitioners should immediately verify network exposure, apply available updates, and implement detection rules for this maximum-severity vulnerability.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
Attackers are exploiting CVE-2026-58115, a critical vulnerability in Node-RED that affects industrial control systems and operational technology environments, to deliver a Linux bot. The flaw allows unauthenticated remote code execution on Siemens devices running Node-RED without authentication on the HTTP interface. VulnCheck researchers documented active exploitation beginning October 30, 2026, with a single attacker conducting opportunistic scanning against multiple vulnerabilities across their canary network.
Why it matters: Organizations running Node-RED in OT and ICS environments face immediate risk of unauthorized command execution and malware deployment; practitioners should immediately verify network exposure, apply available updates, and implement detection rules for this maximum-severity vulnerability.
- Source published
- First seen by Cybersecurity Tracker