Have exploitation attempts been observed for CVE-2026-58115?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists CVE-2026-58115 as a known exploited vulnerability. Confidence is high.

What exploitation activity has Previdian observed?

Previdian has not yet recorded sensor-observed exploitation attempts for CVE-2026-58115. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-58115 affects Siemens SIMATIC IoT2050 Advanced. Reported affected version: 0 to < V4.3.4.1.

No. CVE-2026-58115 is not currently listed in CISA KEV.

CVE-2026-58115 Exploitation Attempts Observed in the Wild — SIMATIC IoT2050 Advanced

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

No. CVE-2026-58115 is not currently listed in CISA KEV.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-58115 is an unauthenticated vulnerability affecting Siemens SIMATIC IoT2050 Advanced. A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running...

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Also reported by third-party sources. Confidence is high.

Who is affected?

Siemens / SIMATIC IoT2050 Advanced affected before v4.3.4.1.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

SIMATIC IoT2050 Advanced

A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.

This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.

Vendor Product Affected Status

Siemens Affected

SIMATIC IoT2050 Advanced

Before V4.3.4.1

Affected

Published: 11 Aug 2026
Exploitation Attempts Reported: 03 Nov 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-58115
cert-portal.siemens.com/productcert/html/ssa-834709.html cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/html/ssa-834709.html

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

The Hacker News

Recorded 03 Nov 2026

A trusted third party reported exploitation attempts.

Proof of concept available

GitHub

Recorded 04 Nov 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
The Hacker News First	2026-11-03 08:11 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

10.0 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS

0.9%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Missing Authentication for Critical Function CWE-306

Recent mention · The Hacker News

03 Nov 2026

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that...

Read full advisory

All CVSS Scores

CVSS v4.0 10.0 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

All Mentions

Recent mention · The Hacker News

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

The Hacker News · 03 Nov 2026

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running

Recent mention · TheRegister

Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

TheRegister · 02 Nov 2026

Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

al4n4n/CVE-2026-58115

github · Created 2026-11-04 05:48:18 UTC · 0 stars · AI assessment 94%

CVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.

Timeline

From disclosure to observed exploitation attempts

04 Nov 2026
05:48 UTC

Public PoC available

Public proof-of-concept code published
03 Nov 2026
08:11 UTC

Added to Previdian KEV Feed

High-confidence, third-party report of exploitation attempts
12 Aug 2026
00:00 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 2 months of early warning before Previdian KEV.
11 Aug 2026
12:20 UTC

CVE published

Vulnerability disclosed publicly
29 Jun 2026
12:59 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-58115

Sample API response

{
  "cve_id": "CVE-2026-58115",
  "confidence": "High",
  "cvss_score": 10.0,
  "cvss_estimated": false,
  "epss_score": 0.0089,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-58115

SIMATIC IoT2050 Advanced

CVE References

Exploitation Attempts Observed in the Wild

Proof of concept available

Known exploited vulnerability sources

Scanner coverage

Virtual patch status

Weaknesses

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

All CVSS Scores

All Mentions

Potential Proof of Concepts

Public PoC available

Added to Previdian KEV Feed

Added to the Previdian watchlist

CVE published

CVE ID reserved

Automate this intelligence