pwned.coffeeOrder ticket · today's special · 2 Nov 2026
🔥 On the fly · exploited in the wildScalding · 540°CcriticalOrder up · fix available
OT programming tool: max-severity bug
SIMATIC IoT2050 Advanced
Max-severity bug in OT programming tool exploited to deliver Linux malware
Do this now
It is being exploited: update SIMATIC IoT2050 Advanced to V4.3.4.1 or later, or uninstall Node-RED if you can't update yet.
Fix it
- Upgrade to SIMATIC IoT2050 Advanced V4.3.4.1
- First seen
- Last update
- Fixed in
- V4.3.4.1
- Identifiers
- CVSS
- 10.0
- Source
- news
- On the menu as
Timeline
Fix status: unknown → patched.
First reported.
Receipt
- Exploitation
- Exploited: reported in the wild
- Report “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot.” source
- Checked by hand “Siemens SSA-834709 (read 3 Nov 2026): SIMATIC IoT2050 Advanced before V4.3.4.1 with Node-RED installed is affected by CVE-2026-58115, and Siemens says 'Update to V4.3.4.1 or later version'.” source
- Overheard “Sinisa Markovic , Managing Editor, Help Net Security November 3, 2026 Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some in…” source
- Fix by release line
Product Affected Fixed in Source SIMATIC IoT2050 Advanced < V4.3.4.1 V4.3.4.1 Checked by hand checked - Score
- CVSS 10.0 (critical). CVSS 3.1 10 (CNA siemens) for CVE-2026-58115
- Last checked
Sources: KEV – CVE record ✓ Vendor ✓
Sources
- api.theregister.com: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
- VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products
- Siemens SSA-834709
- helpnetsecurity.com: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Totalone very hot coffee