VulnCheck researchers reported that a maximum-severity vulnerability identified as CVE-2026-58115 in Node-RED, a flow-based programming tool widely used in industrial control systems (ICS) and operational technology (OT), is being actively exploited. Siemens gave the bug a perfect 10-out-of-10 CVSS rating after noting that Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated remote attackers to create malicious flows that execute system commands. On October 30 2026 a VulnCheck canary captured an attacker from IP 4.201.105[.]116 (Brazil) sending a complete exploit, flow and dropper in a single POST /flows, wiring an inject node to an exec node so the command runs as soon as the flow is deployed. Between October 30 and November 1 the same IP targeted the vulnerability 16 times and logged 125 hits against eight other CVEs, suggesting opportunistic mass scanning rather than a focused attack. 1