CVE-2026-58115
Critical10.0A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
- CVSS
- 10.0v4.0
- EPSS (exploit probability)
- 1.0%61th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-11-02 | 1.0% | 61.3% |
| 2026-11-01 | 1.0% | 61.3% |
| 2026-10-31 | 1.0% | 61.3% |
| 2026-10-30 | 1.0% | 61.3% |
| 2026-10-29 | 1.0% | 61.3% |
| 2026-10-28 | 1.0% | 61.2% |
| 2026-10-27 | 1.0% | 61.2% |
| 2026-10-26 | 1.0% | 61.1% |
| 2026-10-25 | 1.0% | 61.1% |
| 2026-10-24 | 1.0% | 61.0% |
| 2026-10-23 | 1.0% | 61.0% |
| 2026-10-22 | 1.0% | 61.0% |
| 2026-10-21 | 1.0% | 60.9% |
| 2026-10-20 | 1.0% | 60.7% |
| 2026-10-19 | 1.0% | 60.7% |
| 2026-10-18 | 1.0% | 60.6% |
| 2026-10-17 | 1.0% | 60.6% |
| 2026-10-16 | 1.0% | 60.6% |
| 2026-10-15 | 1.0% | 60.6% |
| 2026-10-14 | 1.0% | 60.5% |
| 2026-10-13 | 1.0% | 60.3% |
| 2026-10-12 | 1.0% | 60.3% |
| 2026-10-11 | 1.0% | 60.2% |
| 2026-10-10 | 1.0% | 60.2% |
| 2026-10-09 | 1.0% | 60.2% |
| 2026-10-08 | 1.0% | 60.1% |
| 2026-10-07 | 1.0% | 60.1% |
| 2026-10-06 | 1.0% | 60.1% |
| 2026-10-05 | 1.0% | 60.0% |
| 2026-10-04 | 1.0% | 60.0% |
| 2026-10-03 | 1.0% | 60.0% |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Learn
Why it happened and what stops it
The weakness (CWE)
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- SI-4System MonitoringSystem and Information Integrity · mitigates 8 of these techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 7 of these techniques
- AC-3Access EnforcementAccess Control · mitigates 6 of these techniques
- AC-6Least PrivilegeAccess Control · mitigates 6 of these techniques
- AC-2Account ManagementAccess Control · mitigates 5 of these techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 of these techniques