Siemens IoT2050 Advanced flaw CVE-2026-58115 reportedly exploited in the wild
VulnCheck reports that CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced devices, is under active exploitation. The flaw could let an unauthenticated remote attacker run arbitrary code.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- Siemens
- Product
- SIMATIC IoT2050 Advanced
- Status
- Confirmed
- First seen
- Confirmed
What to do
Check Siemens' security advisory for the fixed firmware version and apply it
Restrict network access to affected devices and block unneeded remote connections
Review device logs for unexpected commands or new backdoor activity
Timeline
- Made public by The Hacker News
- First seen by cve.now
- Confirmed as CVE-2026-58115
Evidence 3
- PressThe Hacker News
“A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.”
- SocialMastodon
“VulnCheck has watched attackers hit CVE-2026-58115, a missing-authentication flaw in the Node-RED interface on SIMATIC IoT2050 gateways, since 30 October to drop a Linux bot binary.”
- Socialr/sysadmin
“VulnCheck saw the flaw being used on Oct 30, against its canary systems.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-b9ba4e436f
Has Siemens confirmed it?
Yes. Confirmed as CVE-2026-58115.Source: The Hacker News, Mastodon, r/sysadmin
What should Siemens users do?
Check Siemens' security advisory for the fixed firmware version and apply it. Restrict network access to affected devices and block unneeded remote connections. Review device logs for unexpected commands or new backdoor activity.
Does it have a CVE?
Yes. It is tracked as CVE-2026-58115.Source: CVE-2026-58115