Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS

Siemens is aware of the recently published research regarding exploitation targeting VulnCheck’s vulnerable Node-RED canary instances.

Siemens disclosed the impact of CVE-2026-58115 on SIMATIC IoT2050 Advanced and released a fix on 11 August 2026 via security advisory SSA-834709. Customers are advised to apply the available update.

Following a detailed review, Siemens identified three additional affected products and updated SSA-834709 accordingly. The affected products are covered by the same fix released on 11 August 2026, and the recommended remediation remains unchanged. Customers are strongly advised to apply the available update.

Note: Please be aware that links in the News Article may refer to external websites and content.