Executive Summary
In late October 2026, security researchers identified active exploitation of CVE-2026-58115, a critical unauthenticated access vulnerability in the Node-RED admin API. Node-RED is widely utilized for industrial automation and is embedded in products such as Siemens SIMATIC IoT2050. The observed activity originates from cloud-hosting infrastructure (Microsoft AS8075) and appears to be part of a broader opportunistic scanning campaign that also targets Apache Solr, Joomla, and Gitea.
The attack chain involves a single POST request to the `/flows` endpoint that deploys a logic flow containing malicious `exec` nodes. These nodes trigger a three-layer encoded dropper that downloads a Linux bot binary directly into memory (/dev/shm). Beyond bot deployment, some variants establish persistent backdoors by exposing new, unauthenticated HTTP endpoints on the Node-RED instance, allowing for long-term remote command execution.
This threat is particularly significant for industrial control systems (ICS) and operational technology (OT) environments where Node-RED might be exposed without `adminAuth`. Organizations should immediately audit Node-RED instances for external exposure and check deployed flows for unauthorized HTTP or execution nodes.