A severe security flaw affecting Siemens SIMATIC IoT2050 Advanced devices, identified as CVE-2026-58115 (CVSS score: 10.0), has been actively exploited This article explores exploit cve 2026. . This flaw could enable an attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges," Siemens stated in an advisory dated August 2026.
Siemens advises users to uninstall Node-RED or harden the installation by following these steps: enabling HTTPS access, securing the editor and admin API with credential-based authentication or an OAuth/OpenID provider, and securing HTTP nodes and the Node-RED dashboard with basic authentication. As of October 30, 2026, VulnCheck reported that it observed attackers attempting to exploit CVE-2026-58115 against its honeypot network, with a goal to download and execute a Linux bot.
Specifically, the malicious flow is crafted to run a shell script wrapper that employs wget to download the botnet binary for AMD64 architecture from 85.215.73[.]250. Several requests were configured without a downloader, instead exposing an HTTP endpoint (e.g., /cmd or a randomly named path) connected to an exec node through a function node.
