[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZju9BGbGLdRvcHOxfKm9C23Qh9HpDpsZwxUcqykc8pQ":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4142cd60-462b-416a-b3b5-8e8af0976f5a","Critical Node-RED Flaw Exploited in Attacks","critical-node-red-flaw-exploited-in-attacks-283335","Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells. The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.","A critical vulnerability (CVE-2026-58115) in Node-RED, a low-code tool used in various sectors including ICS\u002FOT devices, is being actively exploited. Attackers are leveraging the missing authentication flaw to execute system commands, deploy Linux bots, and install webshells. Siemens has released patches for affected SIMATIC IoT2050 Advanced devices.","Critical Node-RED vulnerability (CVE-2026-58115) is being actively exploited in attacks.","https:\u002F\u002Fwww.securityweek.com\u002Fcritical-node-red-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F12\u002Findustrial-AI-OT-security.jpeg","2026-11-03T12:10:19+00:00","2026-11-03T13:00:17.600948+00:00",9,[17,20,22],{"name":18,"type":19},"Node-RED","product",{"name":21,"type":19},"SIMATIC IoT2050 Advanced",{"name":23,"type":24},"Siemens","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-58115","Critical Node-RED vulnerability allowing unauthenticated remote command execution.",[23,18,21],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":115,"name":116,"problem":117,"products":118},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[144],{"slug":145,"name":23,"logo_path":146,"roles":147},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"missing-authentication-in-node-red-enables-active-exploitation-in-icsot-environments","Missing Authentication in Node-RED Enables Active Exploitation in ICS\u002FOT Environments","A critical missing authentication flaw in Node-RED (CVE-2026-58115) allowed unauthenticated attackers to execute system commands, deploy Linux bots, and install webshells on affected devices, including Siemens SIMATIC IoT2050 Advanced units used in industrial control environments. The root cause is twofold: the application shipped without enforcing authentication on sensitive endpoints, and organizations failed to apply available patches before active exploitation began. This is particularly dangerous in ICS\u002FOT contexts where compromised devices can bridge IT and operational technology networks, potentially causing physical-world consequences. The incident highlights that low-code platforms with broad system access must be held to the same security standards as any critical infrastructure component.",[154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 17: Incident Response Management":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 requires essential and important entities—including those operating ICS\u002FOT infrastructure—to implement appropriate technical measures for incident handling and vulnerability management, directly applicable to this actively exploited flaw.","SI-2 requires organisations to identify, report, and remediate system flaws within defined timeframes; adherence would have mandated patching Node-RED as soon as Siemens released the fix.","With active exploitation confirmed, a mature incident response plan would define containment steps—isolating affected nodes, collecting forensic evidence, and eradicating webshells—limiting attacker dwell time and operational impact.","Node-RED running a version with a known critical CVE is a textbook instance of this risk category, which mandates tracking component versions and patching or replacing vulnerable dependencies promptly.","Regular authenticated scanning of internet-facing and OT assets would have surfaced the unpatched Node-RED instance before attackers exploited it, enabling timely remediation.","This control requires timely identification and remediation of technical vulnerabilities; applying it to Node-RED deployments in ICS environments would have triggered patch action before exploitation occurred.","The missing authentication flaw is a direct violation of this control, which requires that access to systems and interfaces is managed and authenticated before sensitive operations are permitted."]