# Attackers exploit critical Node-RED flaw to target exposed Linux devices

- URL: https://talkfuse.com/story/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/
- Published: 2026-11-02T22:55:17+00:00
- Updated: 2026-11-03T02:07:42+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086
- Topics: Cybersecurity, Technology

## Key points

- Attackers are exploiting a maximum-severity Node-RED bug.
- VulnCheck recorded 16 attempts against the flaw in three days.
- Researchers urge users to check exposure and apply updates.

## Summary

Criminals are exploiting a maximum-severity Node-RED vulnerability to install Linux malware on exposed devices. The tool is used to automate workflows in industrial control and operational technology systems, so attacks on connected equipment can carry risks beyond ordinary IT disruption.

The flaw, CVE-2026-58115, has a CVSS score of 10 and allows unauthenticated access to programming nodes on affected Siemens devices, enabling attackers to run system commands. VulnCheck observed one IP address exploit it 16 times between 30 October and 1 November, alongside attempts against seven other vulnerabilities. Researchers have not retrieved the malware, and say the broad mix of targets suggests opportunistic scanning; they advise checking exposure, applying available updates and adding detections.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.