UNKNOWN: SIMATIC IoT2050 Advanced <V4.3.4.1 with Industrial OS + Node-RED lacks authentication on the Node-RED HTTP interface; unauthenticated remote attackers can create malicious flows and execute arbitrary code with maximum privileges. Siemens rates CVSS 10.0 and provides V4.3.4.1+ plus Node-RED/network mitigations.
Evidence boundary: Current exploitation prevalence, successful victims, actor/campaign identity, exposure denominator or realized process/safety impact.
UNKNOWN: CISA ICS material tracks the same affected Siemens product, unauthenticated command-execution impact and V4.3.4.1 remediation. CISA ADP/Vulnrichment on 2026-08-12 recorded Exploitation:none, Automatable:yes, Technical Impact:total.
Evidence boundary: The August Exploitation:none value does not refute later October telemetry and does not prove current CISA KEV inclusion.
UNKNOWN: A current tracked record reports CVE-2026-58115 added to VulnCheck KEV on 2026-10-30, creating a fresh exploitation-state delta relative to the August CISA ADP record.
UNKNOWN: The Exploit Bulletin reports VulnCheck Canary sensors observed exploitation attempts against CVE-2026-58115 on 2026-10-30 and 2026-10-31; it repeats Siemens affected/fixed state and mitigation guidance.
Evidence boundary: Independent second exploitation origin, successful victim compromise, actor attribution, payloads or OT process manipulation.
Open Follow-up
OPEN [HIGH]: SUCCESS_AND_SCALE — No public authoritative denominator of successful compromises, attack volume, victims or affected-sector distribution for CVE-2026-58115.
OPEN [HIGH]: EXPOSURE_PREVALENCE — No reliable public denominator of reachable vulnerable SIMATIC IoT2050 Advanced devices with Node-RED enabled and affected versions.
OPEN [HIGH]: PAYLOAD_OT_IMPACT — No public primary incident evidence recovered for payload behavior, process manipulation, safety effects, persistence or downstream post-exploitation actions on a successfully compromised victim.
OPEN [MEDIUM]: ATTRIBUTION_CAMPAIGN — Actor identity, infrastructure, campaign clustering, motives and ransomware relationship remain unproven.