Cybersecurity researchers have detected renewed scanning activity targeting SAP NetWeaver systems, with attackers searching for vulnerable file-upload endpoints and previously installed webshells. The activity highlights the continuing threat posed by a critical vulnerability that allows unauthenticated attackers to upload malicious files to exposed enterprise systems. The latest activity was documented by Johannes B. Ullrich, Dean of Research at SANS.edu, after a suspicious request appeared in the institution's honeypot data.

VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens…

The image handler in the WordPress and Joomla builder lets anyone write a PHP file to the uploads folder. YOOtheme fixed it in 5.0.53 on 21 October; Unit 42 saw webshells two days later and JPCERT/CC…

Huntress says attackers who exploited AhsayCBS flaws before hotfixes shipped left webshells, two cryptocurrency miners, tunneling tools and a custom implant on backup servers, and that patching alone will not remove them.

Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells.

Introduction: Ransomware Operators Face Stronger Runtime Defenses Two separate ransomware-related investigations highlight how sophisticated threat actors are combining legitimate administration tools, memory-resident malware, vulnerable drivers, and security-disabling utilities to evade endpoint defenses. Kaspersky has analyzed a Storm-2603-attributed intrusion involving a malicious SharePoint webshell, Velociraptor, and tunneling utilities. In a separate October 2026 incident, Anubis ransomware operators deployed an extensive defense-evasion toolkit, including a newly identified backdoor and multiple vulnerable drivers.

Active exploitation reported Unauthenticated vulnerability November 3, 2026 Introduction: Attackers Turn Exposed Node-RED Systems into Linux Botnet Infrastructure A serious security vulnerability affecting Node-RED-based environments is reportedly being exploited by attackers to compromise exposed systems, deploy Linux-based bots, and establish persistent access through malicious webshells. According to reporting from VulnCheck, threat actors have exploited CVE-2026-58115, an unauthenticated vulnerability that allows attackers to abuse Node-RED's flow functionality.

A critical vulnerability affecting Node-RED, a widely used low-code programming platform, is now being actively exploited by attackers to compromise exposed systems, deploy Linux bot malware, and establish persistent remote access through webshells. With a maximum CVSS score of 10.0, the flaw presents a serious risk to organizations using Node-RED, particularly those operating industrial control systems (ICS) and operational technology (OT) environments.

Eine kritische Schwachstelle in einer Nextcloud-Erweiterung wird seit September aktiv ausgenutzt. Ein Update auf Version 26.4.303 schließt sie, bereits platzierte Webshells entfernt es aber nicht. Betroffen ist nur die optionale App.

Active exploitation of Node-RED flaw (CVE-2026-58115) is delivering a Linux bot and webshells to unprotected servers.

Active exploitation of Node-RED flaw (CVE-2026-58115) is delivering a Linux bot and webshells to unprotected servers.

## 1. Overview * Article Title: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products * Source: VulnCheck * Published Date: 2026-11-02 * Original: VulnCheck * Related Sources: Siemens SSA-834709, SecurityWeek: Critical Node-RED Flaw Exploited in Attacks, Node-RED: Securing Node-RED * Associated Malware: Unretrieved Linux bot payload * Threat Actors: Unattributed * Associated CVE: CVE-2026-58115 * Related Products: Node-RED; Siemens SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed (the officially affected configuration) * Severity: critical ## 2. Executive Summary Security firm VulnCheck reported observing active attack requests attempting to deploy Linux binaries or persistent webshells by automatically executing OS commands via a single `POST /flows` request, targeting a vulnerability (CVE-2026-58115) that allows unauthenticated deployment of Node-RED flow definitions. However, the observation was made against a honeypot (canary environment) operated by VulnCheck; successful compromises in production industrial control and IoT systems, as well as the specific functionalities of the unretrieved payloads, have not been confirmed. Automated scanning exploiting paths leading to unauthenticated remote code execution has been observed, with a single source IP conducting broad scans across multiple vulnerabilities. While official impact has been confirmed for Siemens SIMATIC IoT2050 Advanced Industrial OS with embedded Node-RED, whether this CVE number applies under the same conditions across other vendor hardware or standalone Node-RED environments requires individual verification. ## 3. Attack Flow Several variants of the observed attack requests exist, structured based on flow definitions sent to the canary environment. Attack Variant | Initial Request | Execution Mechanism | Prerequisites and Characteristics ---|---|---|--- Variant A: External Downloader Type | Single `POST /flows` | An inject node triggers an exec node one second after deployment, executing a Base64-decoded shell command | Requires `wget` or `curl`, write and execution permissions in `/dev/shm` or `/tmp`, and outbound communication to an external payload server Variant B: HTTP In Webshell Deployment | Single `POST /flows` | Creates a new HTTP In endpoint, registering a flow that passes input queries through a function node to an exec node | Does not require downloading external binaries; commands can be launched with Node-RED's OS privileges if the deployment creates a reachable HTTP endpoint. Preservation and removal of stored malicious flows are also necessary ### Procedure from Single POST to Payload Execution and Webshell Deployment 1. **Management API Discovery and Request Submission** : An attacker scans for unprotected Node-RED management APIs exposed on the internet and sends a `POST /flows` containing a crafted JSON flow definition. 2. **Execution Trigger Branching** : In the downloader type, an inject node (`once: true`) sends a message one second after deployment, triggering the Base64-decoded shell execution embedded in the exec node command field. The webshell type does not require an inject node, instead using subsequent HTTP requests as execution triggers. 3. **Command Execution and Subsequent Deployment** : * **Downloader Type** : The downloader decodes the Base64 string and pipes it to `sh`. Depending on the variant, the command fetches and runs a Linux binary at `/dev/shm/.b`, a different payload at `/tmp/.kworker`, or the staged shell script `wget.sh` at `/tmp/.s` (executed with `sh`). * **Webshell Type** : Registers a new HTTP endpoint and operates a flow that executes parameters included in external web requests directly as OS commands. ## 4. Attacker Position and Execution Location * The attacker sends requests from an external network with HTTP access to Node-RED's management port (default 1880, etc.). Additional payloads are downloaded from a separate attacker-controlled server. ## 5. Perspective of Victims and Administrators ### Victim * General OT and industrial automation personnel may not notice anomalies immediately; impacts may surface as increased CPU load on devices, unknown external traffic, or malfunctions in automation processes. ### Administrator * Observable indicators include `POST /flows` entries in Node-RED access logs, unexpected flow revision updates, the addition of unknown inject, exec, or http in nodes, hidden files created in `/dev/shm` or `/tmp`, and HTTP traffic destined for external IPs. ## 6. Success and Failure Conditions ### Success Conditions * The attacker has direct network access to the Node-RED management API, and authentication mechanisms such as `adminAuth` are not configured or are misconfigured, permitting flow modifications. * The Node-RED process can launch an OS shell via the exec node. The downloader type requires outbound communication and execution permissions in specific directories, whereas the webshell type does not require outbound communication to fetch external payloads, but does require the attacker to reach the HTTP endpoint. ### Failure Conditions and Mitigations * Remove public internet exposure of the Node-RED editor and admin API. Enable authentication with `adminAuth`, and separately restrict network access with IP allowlists. * Update Siemens SIMATIC IoT2050 Advanced Industrial OS to the patched version (v4.3.4.1 or later). * Minimize Node-RED execution user privileges, restrict unnecessary use of exec nodes, writable directories, and outbound communication, and detect unknown flows by diffing against legitimate definitions. * Note that while `adminAuth` protects editors and management APIs, authentication for already deployed HTTP In endpoints must be managed separately. Malicious flows must be completely removed, and authentication settings on HTTP nodes must also be verified. ## 7. What Happens Upon Success * Arbitrary OS command execution under the Node-RED process execution privileges (root in some environments). * Retrieval and execution of external Linux payloads. Specific functionalities remain unconfirmed as payloads were not retrieved. * Establishment of a persistent webshell via HTTP endpoints on Node-RED. ## 8. Observable Logs Inference: The following outlines potential log sources to investigate within your organization. This depends on log collection and retention settings and does not imply that all log outputs were confirmed in the primary source. * **Email** : No observations specific to this incident in the primary source. * **Proxy / SWG / DNS** : Management port access from source IPs identified during investigation (e.g., `4.201.105.116`), and traffic destined for payload delivery servers (`85.215.73[.]250:8080`, `45.194.90[.]57:38472`). * **Endpoint / EDR** : Process clusters where Node.js processes spawn `sh`, `wget`, `curl`, `chmod`, `setsid`, and `nohup`. Suspicious executables such as `/dev/shm/.b` or `/tmp/.kworker`. * **Identity / IdP** : Unknown sessions or login attempts in environments with authentication enabled. In unauthenticated environments, the absence of authentication logs itself becomes a blind spot. * **SaaS / Cloud** : Security group and firewall rule change histories for cloud-hosted Node-RED instances. * **Network** : Outbound HTTP traffic immediately following `POST /flows` requests, and requests destined for unknown HTTP In endpoints. ## 9. Attack Success Assessment ### Attack Attempt Observed (Success Unconfirmed) * **Assessment Stage** : Attack Attempt Observed (Success Unconfirmed) (`contact_only`) / Scope: VulnCheck canary environment telemetry * **Basis** : VulnCheck's honeypot received attack requests and returned successful responses (HTTP 200), but there is no evidence of OS commands executing on production industrial equipment or confirmed payload infection facts, so it is not assessed as successful. ## 10. Investigation Playbook Inference: The following is an incident investigation procedure for your organization. ### Trigger * Initiated by suspicious `POST /flows` requests targeting Node-RED, unexpected flow updates, or the detection of shells and download tools spawned from Node.js processes. ### Initial Triage * Verify source IPs, receipt timestamps, HTTP bodies (injected flow definitions), response codes, flow revisions, running Node-RED versions, and `adminAuth` configuration status. ### Endpoint * Preserve the process tree of the Node-RED host, stored `flows.json`, suspicious files in `/dev/shm` and `/tmp`, network sockets, and memory dumps. ### Identity / Cloud * Inspect reverse proxy configurations, cloud security groups, and management account authentication logs. ### Subsequent Compromise * Track access to deployed webshell endpoints, internal network scans, and whether abnormal commands were sent to industrial control (OT) protocols. ### Containment * Immediately restrict network access to the management ports. Preserve malicious flow definitions and related logs, then disable and remove the malicious flows while retaining the evidence. Restore legitimate flows from known-good backups, isolate the host, and apply patches. ### Assessment * Evaluate and separate the stages of scan contact, flow deployment, command invocation, payload retrieval, and webshell exploitation. ## 11. Defense and Detection Ideas ### Single Event Detection * Detect `POST /flows` requests from external networks that include `exec` nodes or `inject` nodes with `once: true` within flow definitions. ### Timeline Correlation * Perform timeline correlation analysis on flow definition updates, child process creation from Node.js, HTTP connections to external IPs, and the creation of unknown HTTP listeners. ### Threat Hunting Perspectives * Search all Node-RED environments within the organization for unauthenticated management consoles, usage of `exec` nodes, wired connections leading directly from HTTP In to exec, and known IOC files. ### Logging Blind Spots * In the absence of flow modification audit logs or reverse proxy access logs, it becomes difficult to retrospectively prove who injected what flows and when. ### Priority Mitigations * Prioritize hiding management interfaces from the public internet, enabling `adminAuth`, applying patches to embedded products such as SIMATIC IoT2050, and minimizing execution privileges. ## 12. Facts, Inference, and Hypothesis ### Facts * On October 30, 2026, VulnCheck observed unauthenticated `POST /flows` requests targeting CVE-2026-58115 in its canary environment, confirming 16 related events from the same IP by November 1. * Attack requests included complete flow definitions designed to decode Base64 commands and pass them to a shell one second after deployment, utilizing `wget` or `curl` to fetch and execute Linux binaries. * The same source IP conducted a total of 125 access attempts across eight different CVEs including Node-RED, exhibiting characteristics of indiscriminate mass scanning covering both old and new vulnerabilities. * Additional requests included those deploying alternative payloads (`.kworker`) and registering webshell-type flows that accept arbitrary OS commands via query parameters. * VulnCheck was unable to retrieve or analyze binaries, `wget.sh`, or `.kworker`, and specific functionalities such as reverse shells, miners, or DDoS bots remain unidentified. * Siemens advisory (SSA-834709) targets SIMATIC IoT2050 Advanced Industrial OS versions prior to 4.3.4.1 with embedded Node-RED, urging updates to that version. ### Inference * Inference: Because different payloads and User-Agents are sent from the same IP, it is highly likely that shared, rented, or compromised scanning infrastructure is being abused rather than infrastructure dedicated to a single attacker. * Inference: Files placed in `/dev/shm` disappear upon reboot, but webshells registered as flow definitions persist after reboot; therefore, the absence of files alone does not rule out a compromise. ### Hypothesis No additional hypotheses. Unconfirmed items are noted in "Unknowns and Limitations". ## 13. MITRE ATT&CK Mappings ID | Technique | Confidence | Basis ---|---|---|--- T1190 | Exploit Public-Facing Application | high | Observed attack requests sending `POST /flows` to unauthenticated Node-RED management APIs to deploy command execution nodes. T1059.004 | Unix Shell | high | Confirmed commands piping Base64 decode results to `sh` for downloading, permission changing, and background execution. T1105 | Ingress Tool Transfer | high | Confirmed requests fetching Linux binaries from external servers using `wget` or `curl`. T1505.003 | Web Shell | high | Observed webshell-type flows directly connecting HTTP In nodes to exec nodes to execute remote commands via URL parameters. ## 14. Unknowns and Limitations * Although the canary environment returned successful responses, no individual victim cases where payloads successfully executed in production Node-RED environments have been publicly reported. * The functionalities of unretrieved binaries, the identities of threat actors, and the existence of victim organizations remain unknown. * The official scope of the CVE is Siemens SIMATIC IoT2050 Advanced (prior to 4.3.4.1) running Industrial OS with Node-RED. Whether this CVE number applies uniformly to other vendor products or standalone Node-RED environments requires verification with each vendor. ## 15. Impact on SOCs and Organizations Organizations operating Node-RED or SIMATIC IoT2050 in manufacturing, infrastructure facilities, building automation, and other sectors must urgently inspect whether management interfaces are inadvertently exposed to the internet and ensure that `adminAuth` is properly configured. It is important to note that automated attack requests complete in a single POST, and establishing monitoring to detect suspicious requests to management APIs as well as the unauthorized addition of exec or HTTP In nodes within flows is critical. ## 16. Summary by Target * **SOC** : Monitor for `POST /flows` occurrences, unauthorized additions of exec nodes, communications destined for payload servers, and hidden files in `/dev/shm` or `/tmp`. * **Administrators** : Restrict management ports to internal closed networks, enable `adminAuth`, and apply Siemens product patches (v4.3.4.1 or later). * **Users** : Report unexpected automation behaviors or flow modifications promptly to system administrators.

There is an active exploit of a critical security vulnerability in Node-RED by threat actors to install malicious Linux bots and webshells on vulnerable systems. It is believed that the attacks, detected by cybersecurity firm VulnCheck, could result in compromised instances and industrial environments being exposed to remote command execution and unauthorized access.  Tracked as CVE-2026-58115, the vulnerability has a CVSS severity rating of 10.0. Node-RED HTTP interface does not contain authentication, allowing remote attackers to access programming functions and execute system commands on the underlying server if unauthenticated remote attackers are not authenticated.  A browser-based editor enables users to build event-driven applications using Node-RED, an open-source, flow-based programming tool. It is widely used in industries including manufacturing, healthcare, home automation, and industrial control systems. A number of Siemens IoT2050 Advanced devices have been integrated with the platform, including Siemens SIMATIC IoT2050 Advanced devices. Siemens disclosed the vulnerability on August 11, 2026, after identifying the issue with SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. In order to take advantage of this vulnerability, attackers could create malicious programming flows and execute arbitrary code with maximum privileges if it is successfully exploited. A fix for the vulnerability is available in Siemens SIMATIC IoT2050 Advanced version 4.3.4.1 and later. Although security updates have been available, attackers continue to target vulnerable instances. A malicious request containing a complete exploit was captured by one of VulnCheck's monitoring systems on October 30, when it was detected as successful exploitation. This attack deployed a Node-RED flow, triggered its execution automatically, and downloaded a binary from a server controlled by the attacker.  A malicious execution flow was initiated using Node-RED components, including the inject and execute nodes, without requiring additional interaction from the attacker. There has been no indication of the exact purpose of the downloaded binary, identified as bot-linux-amd64, which was stored under a hidden filename in a memory-backed location and executed in the background.  Researchers were unable to retrieve the binary for further examination. During the exploitation campaign conducted between October 30 and November 1, repeated attempts were made from the same IP address. The attack vectors used by VulnCheck are 16 attempts to exploit CVE-2026-58115, with attackers delivering a variety of payloads across multiple requests.  The address used by the attackers originates from Microsoft's AS8075 network, which is located in Brazil. A researcher cautioned that the use of cloud providers' networks does not necessarily identify threat actors, since such infrastructure may include virtual machines rented or compromised by cloud providers. Other attempts were made to install webshells, which gave attackers access to compromised servers and the ability to execute commands remotely, in addition to deploying Linux bots. In some instances, additional shell scripts and files appeared to be legitimate Linux kernel processes. As opposed to the originally observed bot, which was stored in memory and could be removed when the system was rebooted, the webshells provided a more persistent method of access. In addition to identifying broader scanning activity from the same IP address, VulnCheck also recorded 125 requests targeted at eight different vulnerabilities affecting Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla.  A survey of Node-RED installations indicates opportunistic mass scanning rather than activity concentrating exclusively on Node-RED installations Security experts have expressed concerns about the vulnerability of industrial environments through poorly secured Node-RED deployments.  Industrial controllers are often integrated with databases, messaging systems and cloud services through this platform, allowing the platform to hold credentials for multiple connected systems. Consequently, a compromised instance could give attackers access beyond the initial server and facilitate movement across networks in the areas of information technology and operational technology. It is also important to note that Node-RED deployments are not always managed by dedicated IT security teams, increasing the risk.  It is common for engineers and operational staff to configure Node-RED installations directly, thus preventing regular asset inventories and security monitoring. Additionally, scheduled maintenance requirements can delay firmware updates in industrial environments, resulting in vulnerable devices remaining exposed even after patches have been released. CVE-2026-58115 has been added to VulnCheck's Known Exploited Vulnerabilities (KEV) catalog in response to the observed attacks. When reported, this vulnerability was not listed in CISA's KEV catalog. It is recommended that organizations using Node-RED apply security updates, enable authentication via the adminAuth setting, and restrict external network access to the editor.  The security team should also examine deployed flows for unanticipated executable nodes, unauthorized HTTP endpoints, and suspicious file modifications. It is equally important to examine system logs and outbound network connections for signs of compromise, as installing patches alone may not remove webshells or other malicious components already present on the system. Node-RED deployments exposed to industrial environments may pose security risks resulting from the active exploitation of CVE-2026-58115. It is recommended that organizations prioritize patching, enforce authentication, limit access to the editor and investigate for signs of compromise. In light of the possibility of existing webshells remaining after updates have been applied, security checks should accompany remediation efforts as well.

Everyone is talking about that $6.43 billion Binance theft. The story has already been written; north Korean state actors allegedly used AI social engineering to run fake job interviews that looked real, which tricked staff into installing malware that bypassed every single…

TL;DR Security firm VulnCheck warned on November 2, 2026, that threat actors are actively exploiting a critical Node-RED RCE flaw in the wild. Tracked as CVE-2026-58115 with a maximum 10.0 CVSS score, the missing-authentication vulnerability lets unauthenticated remote attackers execute arbitrary system commands on exposed hosts. Attackers deploy malicious flows to drop Linux bot implants and install persistent webshells across operational technology networks.