# SZB-b9ba4e436f: Siemens IoT2050 Advanced flaw CVE-2026-58115 reportedly exploited in the wild

VulnCheck reports that CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Siemens SIMATIC IoT2050 Advanced devices, is under active exploitation. The flaw could let an unauthenticated remote attacker run arbitrary code.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Siemens
- Product: SIMATIC IoT2050 Advanced
- Status: Confirmed
- Sources: 3 distinct
- First seen: 2026-11-03 05:36 UTC
- Confirmed: 2026-11-03 05:36 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Check Siemens' security advisory for the fixed firmware version and apply it
- Restrict network access to affected devices and block unneeded remote connections
- Review device logs for unexpected commands or new backdoor activity

## Timeline

- 2026-11-03 05:34 UTC: Made public by The Hacker News
- 2026-11-03 05:36 UTC: First seen by cve.now
- 2026-11-03 05:36 UTC: Confirmed as CVE-2026-58115

## Evidence (3 sources)

- 2026-11-03 · Press · [The Hacker News](https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html): “A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.”
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@adrianhollister/117551775173117261): “VulnCheck has watched attackers hit CVE-2026-58115, a missing-authentication flaw in the Node-RED interface on SIMATIC IoT2050 gateways, since 30 October to drop a Linux bot binary.”
- 2026-11-03 · Social · [r/sysadmin](https://www.reddit.com/r/sysadmin/comments/1xn4skx/attackers_are_exploiting_nodered_cve202658115/): “VulnCheck saw the flaw being used on Oct 30, against its canary systems.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-b9ba4e436f&body=https%3A%2F%2Fcve.now%2FSZB-b9ba4e436f%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-b9ba4e436f

### Has Siemens confirmed it?

Yes. Confirmed as CVE-2026-58115.

Source: https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html, https://infosec.exchange/@adrianhollister/117551775173117261, https://www.reddit.com/r/sysadmin/comments/1xn4skx/attackers_are_exploiting_nodered_cve202658115/

### What should Siemens users do?

Check Siemens' security advisory for the fixed firmware version and apply it. Restrict network access to affected devices and block unneeded remote connections. Review device logs for unexpected commands or new backdoor activity.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-58115.

Source: https://cve.now/CVE-2026-58115

## Tracked as

- [CVE-2026-58115](https://cve.now/CVE-2026-58115.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-b9ba4e436f
Site guide for agents: https://cve.now/llms.txt