In a November 1 update, VulnCheck described later exploit requests that deployed HTTP-in flows connected to exec nodes, which the cybersecurity firm said could persist after a reboot. VulnCheck had first recorded exploitation of CVE-2026-58115 in a canary on October 30. VulnCheck’s account

How the reported Node-RED exploit worked

The flow described by VulnCheck connected Node-RED’s built-in inject and exec nodes. Deploying the flow triggered a shell command. In the later variant, an HTTP-in node provided a webshell-style endpoint wired to an exec node; VulnCheck said those flows could survive a reboot.

An earlier dropper tried to download a binary named bot-linux-amd64 to /dev/shm, a memory-backed filesystem, and launch it detached. The filename suggests a Linux AMD64 target. VulnCheck said it did not retrieve the binary or staged scripts, so their functions are unknown.

What VulnCheck recorded in its canary

VulnCheck reported that its canary returned HTTP 200 and a new flow revision hash after an exploit request. The firm recorded 16 events against CVE-2026-58115 from one IP between October 30 and November 1, 2026. Across its wider canary network, that IP generated 125 hits against eight CVEs.

The first figure counts events against this CVE; the second covers hits across eight CVEs. VulnCheck characterized the activity as opportunistic mass scanning and reported different payloads, rather than a single repeated bot deployment.

Which Siemens device the advisory covers

CISA’s advisory, which republishes Siemens ProductCERT’s notice, lists SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED installed, at versions earlier than V4.3.4.1. The flaw is missing authentication on Node-RED’s HTTP interface. The advisory rates CVE-2026-58115 10.0 Critical on CVSS v3.1. CISA’s Siemens advisory

For that configuration, the advisory lists three options: harden the Node-RED installation, uninstall Node-RED, or update to V4.3.4.1 or later. CISA also recommends keeping control-system devices off the internet and minimizing their network exposure.