Exploited vulnerability

CVE-2026-58115

TLP:CLEAR

Missing Authentication for Critical Functionality

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

Facts

Vendor: Siemens
Product: SIMATIC IoT2050 Advanced
EPSS (probability of exploitation within 30 days): 1 %
First known exploitation: 30 October 2026
First seen by Risk Letters: 30 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD