Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)

VulnCheck reports that threat actors are actively abusing an unauthenticated access-control bug in Node-RED, tracked as CVE-2026-58115, to plant a Linux bot and persistent webshells on exposed servers. Node-RED is a flow-based automation engine built on Node.js that ships inside several industrial products, including Siemens' SIMATIC IoT2050 Advanced, and Siemens rated the issue a maximum CVSS 10.0 when it disclosed it in August, warning that any device running Industrial OS with Node-RED below version V4.3.4.1 is exposed. A VulnCheck honeypot captured a live attack on October 30, 2026: a single request built a malicious flow combining an inject node and an exec node, then fetched and launched a binary called bot-linux-amd64 through triple-layered encoding, hiding it in memory. The same source IP, traced to a Microsoft Azure range geolocating to Brazil, hit the Node-RED bug 16 times in three days and was also seen probing eight other CVEs in Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, suggesting broad opportunistic scanning rather than a targeted campaign. Later attack waves dropped additional payloads disguised as kernel processes and installed webshells for persistent remote access, and VulnCheck has already added the flaw to its own KEV list even though CISA had not yet done so; organizations running Node-RED, especially in OT settings, are urged to check external exposure, enable adminAuth, apply the Siemens update, and watch for the published indicators of compromise.