CVE-2026-58115: Siemens SIMATIC IoT2050 Flaw Exploited

# CVE-2026-58115: Siemens SIMATIC IoT2050 Flaw Exploited

https://gcdradar.vercel.app/incidents/cve-2026-58115-siemens-simatic-iot2050-flaw-exploited · AIR-2026-1726 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed active exploitation in the wild.
- Fix status: Fix status unknown
- First reported: 2026-11-03
- AI role: No AI role
- Products: SIMATIC IoT2050 Advanced
- CVE ids: CVE-2026-58115
- CVSS: 10

## Summary

Attackers are actively exploiting a maximum-severity missing authentication vulnerability in Siemens SIMATIC IoT2050 Advanced devices. The flaw allows unauthenticated remote attackers to execute arbitrary code and install backdoors.

## What to do

Check vendor advisories for updates and restrict network access to vulnerable devices.

## Affected and fixed versions

- Affected: SIMATIC IoT2050 Advanced

## Latest updates

- 2026-11-03: New analysis reveals the authentication flaw affecting Node-RED is being exploited to deploy Linux bots and backdoors. (https://helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation)
- 2026-11-03: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors (https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html)

## Sources

- 2026-11-03 The Hacker News: Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html
- 2026-11-03 Help Net Security: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) https://helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.