Attackers are exploiting a security flaw in Node-RED to install Linux malware and backdoors on vulnerable servers.
Node-RED is a programming tool used to build applications and automate systems. It is widely used in manufacturing, healthcare, and industrial environments. The tool is also included in some industrial products, such as Siemens SIMATIC IoT2050 Advanced devices.
Tracked as CVE-2026-58115, the vulnerability allows attackers to access vulnerable systems without authentication, create malicious workflows, and execute commands with full system privileges.
According to VulnCheck, the first confirmed attack was detected on October 30, 2026. Attackers used the flaw to create a malicious workflow that automatically downloaded and launched a Linux binary from an attacker-controlled server. Researchers were unable to obtain the file, so it’s unclear what the malware was intended to do.
Further attacks also delivered shell scripts and webshells, giving attackers a way to execute commands and maintain access to compromised systems. Unlike the malware stored in memory, some of the backdoors can remain active even after a system restarts.
Siemens previously warned that devices running Industrial OS with Node-RED versions earlier than V4.3.4.1 are vulnerable.