{"metadata": {"vulnerability": "CVE-2026-58115", "count": 92, "kinds": {"milestone": 9, "sighting": 56, "kev": 5, "other": 22}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0282", "record": "NCSC-2026-0282", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-06-29T12:59:54.795Z", "date_only": false, "value": "2026-06-29T12:59:54.795Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58115", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-834709", "record": "SSA-834709", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": true, "value": "2026-08-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1009", "record": "CERTFR-2026-AVI-1009", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-834709", "record": "SSA-834709", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-11T12:20:24.045Z", "date_only": false, "value": "2026-08-11T12:20:24.045Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58115", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-11T12:39:25.543Z", "date_only": false, "value": "2026-08-11T12:39:25.543013Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0282", "record": "NCSC-2026-0282", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-11T12:39:25.543Z", "date_only": false, "value": "2026-08-11T12:39:25.543013Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0282", "record": "NCSC-2026-0282", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-11T12:39:25.543Z", "date_only": false, "value": "2026-08-11T12:39:25.543013Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0282", "record": "NCSC-2026-0282", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-08-11T13:19:00Z", "date_only": false, "value": "2026-08-11T13:19:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MMH6-F99Q-64FH", "record": "GHSA-MMH6-F99Q-64FH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-08-11T13:19:00.190Z", "date_only": false, "value": "2026-08-11T13:19:00.190", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58115", "record": "FKIE_CVE-2026-58115", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-11T13:30:05.620Z", "date_only": false, "value": "2026-08-11T13:30:05.620993Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msspvzojdv2d", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "cbe214db-129c-4083-96b7-28b75c469fa6", "content": "CVE-2026-58115 - simatic iot2050 advanced\nCertain versions of SIMATIC IoT2050 Advanced without the latest security patch allow unauthenticated remote access to programming nodes that can execute system commands. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siemens #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3msspvzojdv2d"}, {"timestamp": "2026-08-11T15:32:36Z", "date_only": false, "value": "2026-08-11T15:32:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MMH6-F99Q-64FH", "record": "GHSA-MMH6-F99Q-64FH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-11T15:32:37Z", "date_only": false, "value": "2026-08-11T15:32:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MMH6-F99Q-64FH", "record": "GHSA-MMH6-F99Q-64FH", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-12T00:00:00Z", "date_only": false, "value": "2026-08-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1009", "record": "CERTFR-2026-AVI-1009", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-08-12T00:00:00Z", "date_only": false, "value": "2026-08-12T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1009", "record": "CERTFR-2026-AVI-1009", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-12T00:00:00Z", "date_only": false, "value": "2026-08-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1009", "record": "CERTFR-2026-AVI-1009", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-08-12T07:32:23.539Z", "date_only": false, "value": "2026-08-12T07:32:23.539014Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msumfckimq2t", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "7b507e66-f5d8-4de6-aac4-c10fb88028f6", "content": "CVE-2026-58115 is a CVSS 10 flaw letting unauthenticated attackers run code on SIMATIC IoT2050 via Node-RED. Siemens urges an immediate update.\n\n#CVE202658115 #Siemens #NodeRED #RCE #SIMATIC #ICS #Cybersecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3msumfckimq2t"}, {"timestamp": "2026-08-12T12:25:10.439Z", "date_only": false, "value": "2026-08-12T12:25:10.439606Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msv4quhpkr24", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "fc4cc28c-eac0-4b82-9218-94cd9595c3ad", "content": "\ud83d\udd17 CVE : CVE-2026-58115, CVE-2026-59693", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3msv4quhpkr24"}, {"timestamp": "2026-08-12T17:59:33.476Z", "date_only": false, "value": "2026-08-12T17:59:33.476267Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58115", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-12T17:59:33.476Z", "date_only": false, "value": "2026-08-12T17:59:33.476267Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58115", "record": "FKIE_CVE-2026-58115", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-08-12T19:19:54.001Z", "date_only": false, "value": "2026-08-12T19:19:54.001Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58115", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-13T09:46:16.792Z", "date_only": false, "value": "2026-08-13T09:46:16.792785Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1009", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "69326220-df09-4ef6-90b9-45d97b015d99", "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1009"}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": true, "value": "2026-08-20", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-34873", "record": "CNVD-2026-34873", "field": "submitTime", "linked_record": true}, {"timestamp": "2026-08-24T18:48:46.232Z", "date_only": false, "value": "2026-08-24T18:48:46.232482Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-08-25T06:00:00Z", "date_only": false, "value": "2026-08-25T06:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-08-25T06:00:00Z", "date_only": false, "value": "2026-08-25T06:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": true, "value": "2026-09-02", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-34873", "record": "CNVD-2026-34873", "field": "openTime", "linked_record": true}, {"timestamp": "2026-11-03T00:05:42.391Z", "date_only": false, "value": "2026-11-03T00:05:42.391521Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzek4xvdw62y", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "2a30ba84-5d86-4646-9814-ea768ea20988", "content": "A critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. Secure your exposed instances now.\n\n#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzek4xvdw62y"}, {"timestamp": "2026-11-03T04:34:41Z", "date_only": false, "value": "2026-11-03T04:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "1f7b8707-6f3e-4a6e-9206-9fcc13c9dab8", "content": "A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.\n\nThe vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.\n\n\"SIMATIC IoT2050 Advanced devices running", "url": "https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html"}, {"timestamp": "2026-11-03T05:43:05.882Z", "date_only": false, "value": "2026-11-03T05:43:05.882727Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacks.gr/post/3mzf4ybzd3ydn", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "f96a72d5-e9ec-48b7-9a94-0c03ae1863a4", "content": "Attackers are actively exploiting a maximum-severity authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115.\n\nhttps://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/\n\n#Siemens #NodeRED #Vulnerability", "url": "https://bsky.app/profile/hacks.gr/post/3mzf4ybzd3ydn"}, {"timestamp": "2026-11-03T05:52:04Z", "date_only": false, "value": "2026-11-03T05:52:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10542", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4d35a20d-7db3-4b6a-924c-2df433353c6a", "content": "\ud83d\udea8 Critical Siemens IoT2050 flaw under active exploitation.\n\nAttackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.\n\nVulnCheck captured the exploit attempts on its honeypots.\n\nHow the attacks work \u2193 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://t.me/thehackernews/10542", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-03T06:12:04.424Z", "date_only": false, "value": "2026-11-03T06:12:04.424657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsph.com/post/3mzf6m2hhjp2l", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "d583b912-a9be-4b3b-a27d-7edcbc492707", "content": "\u201cThe vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code\u201d, The Hacker News reports.\n\n#cybersecurity", "url": "https://bsky.app/profile/cybernewsph.com/post/3mzf6m2hhjp2l"}, {"timestamp": "2026-11-03T06:25:18.987Z", "date_only": false, "value": "2026-11-03T06:25:18.987976Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mzf7drj3hi2c", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "c92ffc08-5064-4ddd-912d-63312068ab4c", "content": "Siemens SIMATIC IoT2050 Advanced\u306b\u8a8d\u8a3c\u4e0d\u5099\u306e\u8106\u5f31\u6027(CVE-2026-58115)\u304c\u3042\u308a\u3001\u653b\u6483\u8005\u306f\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u8a66\u307f\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mzf7drj3hi2c"}, {"timestamp": "2026-11-03T07:26:36.429Z", "date_only": false, "value": "2026-11-03T07:26:36.429145Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mzfcrf6m3m2q", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "f2cffc0a-fe62-47e5-81ca-48212824a6c7", "content": "\ud83e\udd16 CVE-2026-58115 (CVSS 10.0): missing auth in Siemens SIMATIC IoT2050 Advanced lets unauthenticated attackers run code remotely. VulnCheck reports active exploitation to plant backdoors.\nhttps://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mzfcrf6m3m2q"}, {"timestamp": "2026-11-03T07:39:43Z", "date_only": false, "value": "2026-11-03T07:39:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-siemens-security-advisory-av26-802", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "a175ca83-8da0-40bd-b2c5-eec1f49323ca", "url": "https://cyber.gc.ca/en/alerts-advisories/control-systems-siemens-security-advisory-av26-802"}, {"timestamp": "2026-11-03T08:01:39.728Z", "date_only": false, "value": "2026-11-03T08:01:39.728692Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzfepwvbcm2y", "record": "cve-2026-58115", "field": "creation_timestamp", "uuid": "ade5af71-406e-4424-81a8-071fe2d0ce21", "content": "Siemens IoT2050 Advanced owners should remove or harden Node-RED after VulnCheck reported attacks; NVD has no fixed version published yet.\n\n#authentication #cybersecurity\u2026\nhttps://www.trickyworld.in/computer-tricks/cyber-security/cve-2026-58115-siemens-node-red-backdoor-checks/?utm_medium=social", "url": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mzfepwvbcm2y"}, {"timestamp": "2026-11-03T08:09:54Z", "date_only": false, "value": "2026-11-03T08:09:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/lefwmx4a3iw3PwGakSk1DLgIUxHLoU5TlPEDId9-4VVWpw", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "1cd291da-63f2-4375-b34d-0267121e1ca3", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-03T08:11:27Z", "date_only": false, "value": "2026-11-03T08:11:27+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-58115", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-03T08:11:27Z", "date_only": false, "value": "2026-11-03T08:11:27+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-58115", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-03T08:11:27Z", "date_only": false, "value": "2026-11-03T08:11:27+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-58115", "field": "status.status_updated_at", "uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-03T08:11:27.490Z", "date_only": false, "value": "2026-11-03T08:11:27.490Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-58115", "field": "evidence.0.details.added_date", "uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-03T09:03:30Z", "date_only": false, "value": "2026-11-03T09:03:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/11/03/attackers-exploit-critical-siemens-iot.html", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "59791b12-4c47-4506-b88e-7278c1339cce", "content": "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors\n\nA maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under active exploitation, VulnCheck has found, The Hacker News reports. The missing-authentication flaw could let an unauthenticated remote attacker run arbitrary code on the industrial IoT gateways.", "url": "https://threatintel.cc/2026/11/03/attackers-exploit-critical-siemens-iot.html"}, {"timestamp": "2026-11-03T09:12:08.918Z", "date_only": false, "value": "2026-11-03T09:12:08.918156Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzfio3zmz62p", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "8ccbb684-c018-4626-83cb-5da889711456", "content": "VulnCheck observed attempts to exploit CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Linux payloads and Node-RED command backdoors. Siemens fixed the flaw in version 4.3.4.1 or later.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzfio3zmz62p"}, {"timestamp": "2026-11-03T09:43:53.154Z", "date_only": false, "value": "2026-11-03T09:43:53.154064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzfkgtteb723", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "ae3cec51-26bf-458f-8ad5-a1cef40187f3", "content": "Active Exploitation Attempts Target Siemens SIMATIC IoT2050 Devices Through Critical Vulnerability CVE-2026-58115 +\u00a0Video\n\nIntroduction: Industrial IoT Devices Become Targets for Linux-Based Intrusions Industrial Internet of Things (IIoT) devices are increasingly attractive targets for threat\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzfkgtteb723"}, {"timestamp": "2026-11-03T10:03:56.240Z", "date_only": false, "value": "2026-11-03T10:03:56.240794Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117551938657976967", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "57bb14de-5c06-4c5d-8b34-66c298ffbea2", "content": "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors\nA maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under active exploitation, VulnCheck has found, The Hacker News reports. The missing-authentication flaw could let an unauthenticated remote attacker run arbitrary code on the industrial IoT gateways. https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://infosec.exchange/users/edwardk/statuses/117551938657976967"}, {"timestamp": "2026-11-03T10:03:57.834Z", "date_only": false, "value": "2026-11-03T10:03:57.834698Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzflkqlyhd22", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "ced567a0-d8d1-48ba-9d19-90cfaedf5069", "content": "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors\n\nA maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under... https://threatintel.cc/2026/11/03/attackers-exploit-critical-siemens-iot.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzflkqlyhd22"}, {"timestamp": "2026-11-03T11:15:19.617Z", "date_only": false, "value": "2026-11-03T11:15:19.617159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mzfpkdzagf23", "record": "cve-2026-58115", "field": "creation_timestamp", "uuid": "e5a70c6e-ea5a-4b49-8b3a-8bbdbd9474e2", "content": "siemens simatic iot2050 node-red flaw (cve-2026-58115) exploited by botnet, cvss 10.0. patched in august. #infosec https://0daynews.com/articles/2026-11-03-siemens-iot2050-node-red-cve-2026-58115-exploited/", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mzfpkdzagf23"}, {"timestamp": "2026-11-03T12:04:32.385Z", "date_only": false, "value": "2026-11-03T12:04:32.385390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tecnologiageek.com/post/3mzfscdyo7k2u", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "434249c8-0f66-4a55-a105-3ccb8e3a639d", "content": "Siemens IoT2050 y CVE-2026-58115: ya hay ataques\u00a0reales\n\nEl CVE-2026-58115 del Siemens IoT2050, con nota 10, ya se explota para plantar bots y puertas traseras en plantas....", "url": "https://bsky.app/profile/tecnologiageek.com/post/3mzfscdyo7k2u"}, {"timestamp": "2026-11-03T12:17:42Z", "date_only": false, "value": "2026-11-03T12:17:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4a2dffd7-975f-4bdd-96ec-c77db25170f7", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\n\nAttackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation.", "url": "https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html"}, {"timestamp": "2026-11-03T12:24:53.471Z", "date_only": false, "value": "2026-11-03T12:24:53.471346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mzftgqnczt2d", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "f21d87a1-9c53-4a93-833f-7305daef1df0", "content": "Hackers exploit CVE-2026-58115 in Node-RED to gain unauthenticated access, deploy malicious flows, and execute arbitrary commands with maximum privileges.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mzftgqnczt2d"}, {"timestamp": "2026-11-03T12:26:01.450Z", "date_only": false, "value": "2026-11-03T12:26:01.450791Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mzftir6pbx2y", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "f0680925-a2ce-4ff6-b714-8607bc720246", "content": "Hackers exploit CVE-2026-58115 in Node-RED to gain unauthenticated access, deploy malicious flows, and execute arbitrary commands with maximum privileges.\n", "url": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mzftir6pbx2y"}, {"timestamp": "2026-11-03T12:26:57.392Z", "date_only": false, "value": "2026-11-03T12:26:57.392908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mzftkhckch22", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "060eead3-cfdb-4992-aa5e-54d6df01481c", "content": "Hackers exploit CVE-2026-58115 in Node-RED to gain unauthenticated access, deploy malicious flows, and execute arbitrary commands with maximum privileges.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mzftkhckch22"}, {"timestamp": "2026-11-03T13:10:30.664Z", "date_only": false, "value": "2026-11-03T13:10:30.664578Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mzfvy7zi4226", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "1fbb6a5b-4de7-4fec-94f3-735b07ebb2ee", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\n\n\ud83d\udd17 Read more: www.helpnetsecurity.com/2026/11/03/n...\n\n#vulnerability#malware #cybersecurity", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mzfvy7zi4226"}, {"timestamp": "2026-11-03T13:18:12.108Z", "date_only": false, "value": "2026-11-03T13:18:12.108114Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117552702529974578", "record": "cve-2026-58115", "field": "creation_timestamp", "uuid": "0e1523e6-e011-400f-b2e1-93be3ec30bf0", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\nAttackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation. https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/", "url": "https://infosec.exchange/users/edwardk/statuses/117552702529974578"}, {"timestamp": "2026-11-03T13:18:12.848Z", "date_only": false, "value": "2026-11-03T13:18:12.848004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzfwg4glnn2b", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9a1ceaca-3676-474e-b7a5-2ad656a9204c", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\n\nAttackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotec... https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzfwg4glnn2b"}, {"timestamp": "2026-11-03T14:06:48.179Z", "date_only": false, "value": "2026-11-03T14:06:48.179892Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mzfz4y6vki2j", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "52c7c072-fb69-4176-8c69-0bdf964d353f", "content": "A maximum-severity vulnerability (CVE-2026-58115) in Node-RED, used in critical infrastructure, is being exploited to deploy Linux malware. Siemens identified the flaw, which allows unauthenticated access to execute system commands.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mzfz4y6vki2j"}, {"timestamp": "2026-11-03T14:42:41.190Z", "date_only": false, "value": "2026-11-03T14:42:41.190278Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mzg35463lk2m", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "b68fe09f-3bc7-4f99-af4d-60c634f6445b", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\n\nwww.helpnetsecurity.com/2026/11/03/n...\n\n#Cybersecurity #Cyber #SituationalAwareness", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mzg35463lk2m"}, {"timestamp": "2026-11-03T16:12:09.620Z", "date_only": false, "value": "2026-11-03T16:12:09.620058Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzga55nt4h2b", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9f7d0c45-4488-4b9e-aa16-a9b7102e7e1c", "content": "VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens patched the flaw in SIMATIC IoT2050 Advanced 4.3.4.1 and later.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mzga55nt4h2b"}, {"timestamp": "2026-11-03T16:30:07.987Z", "date_only": false, "value": "2026-11-03T16:30:07.987223Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzgb5c2yak23", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "a661b6aa-a3b2-4ed4-9a56-55c0875ebe9b", "content": "\ud83d\udce2 Exploitation active de CVE-2026-58115 dans Node-RED pour d\u00e9ployer un malware Linux sur des \u00e9quipements OT\n\nThe Register, publi\u00e9 le 2 novembre 2026. L'information est bas\u00e9e sur un advisory publi\u00e9 par VulnCheck (chercheur Patrick\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#NodeRED #LinuxMalware #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mzgb5c2yak23"}, {"timestamp": "2026-11-03T17:30:17.706Z", "date_only": false, "value": "2026-11-03T17:30:17.706953Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzgeitid2o24", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "a8936a38-0fe4-4b03-930d-04d1e68e84d2", "content": "Attackers are exploiting a CVSS 10 Node-RED bug, CVE-2026-58115, to drop Linux bots and webshells on exposed automation boxes, VulnCheck says. Siemens IoT2050 owners: update to 4.3.4.1 and lock the editor.\n\nthreatroundup.com/news/node-re...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzgeitid2o24"}, {"timestamp": "2026-11-03T17:39:42.627Z", "date_only": false, "value": "2026-11-03T17:39:42.627179Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gadgetry.bsky.social/post/3mzgezpcr732r", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "1acdc5e2-fad7-4ed9-aa62-473831baca80", "content": "\u201cThe attacker spent no effort on stealth beyond base64 and a hidden RAM-backed file, which suggests the operation counts on volume rather than subtlety,\u201d VulnCheck's team commented. CVE-2026-58115 is a CVSS 10 Node-RED admin API flaw, and a canary has caught it being exploited to drop Linux bots.", "url": "https://bsky.app/profile/gadgetry.bsky.social/post/3mzgezpcr732r"}, {"timestamp": "2026-11-03T18:33:20.480Z", "date_only": false, "value": "2026-11-03T18:33:20.480001Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzghzlprbi2n", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "277afbf9-4a4f-4a60-baf1-328a59233f22", "content": "Critical Node-RED Vulnerability CVE-2026-58115 Exploited in the Wild to Deploy Linux Bots and Persistent Webshells +\u00a0Video\n\nA critical vulnerability affecting Node-RED, a widely used low-code programming platform, is now being actively exploited by attackers to compromise exposed systems, deploy\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzghzlprbi2n"}, {"timestamp": "2026-11-03T19:15:57.567Z", "date_only": false, "value": "2026-11-03T19:15:57.567873Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrjvm226", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "c8011390-fc6a-4db4-ada7-5ebc13a0db7e", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 \u00b7 71 people\n2. CVE-2026-58115 \u00b7 23 people\n3. CVE-2026-97229 \u00b7 10 people \ud83d\udd25\n4. CVE-2026-86596 \u00b7 9 people\n5. CVE-2026-109618 \u00b7 6 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrjvm226"}, {"timestamp": "2026-11-03T19:15:58.850Z", "date_only": false, "value": "2026-11-03T19:15:58.850249Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrokzc26", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "8c39571a-6bc5-4bd7-93b7-02f7864c08c2", "content": "2. CVE-2026-58115 \u00b7 23 people\n\ud83d\udfe5 Critical 10.0 \u00b7 Siemens SIMATIC IoT2050 Advanced\n\nA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed).", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzgkfrokzc26"}, {"timestamp": "2026-11-03T20:07:38.433Z", "date_only": false, "value": "2026-11-03T20:07:38.433746Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mzgnc7wzkh2y", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "fc488891-3442-427f-ab5e-fc8d5488387d", "content": "~Cybergcca~\nFour advisories cover Zyxel, PostgreSQL, Siemens and WS_FTP; CVE-2026-58115 is exploited in the wild.\n-\nIOCs: CVE-2026-58115\n-\n#CVE-2026-58115 #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/cyfar.ca/post/3mzgnc7wzkh2y"}, {"timestamp": "2026-11-03T20:54:57.094Z", "date_only": false, "value": "2026-11-03T20:54:57.094694Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzgpwsn47d2z", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "7ca09bbe-295e-4e99-9490-13cbe6d56d24", "content": "Critical Node-RED Vulnerability CVE-2026-58115 Exploited in the Wild to Deploy Linux Bots and Persistent Webshells +\u00a0Video\n\nActive exploitation reported Unauthenticated vulnerability November 3, 2026 Introduction: Attackers Turn Exposed Node-RED Systems into Linux Botnet Infrastructure A serious\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mzgpwsn47d2z"}, {"timestamp": "2026-11-03T21:35:07.119Z", "date_only": false, "value": "2026-11-03T21:35:07.119836Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mzgs6nb7sc2d", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "17f10428-d56f-4ee5-8f87-f3d7e5e2cf34", "content": "Node-RED is on fire. Check your logs for CVE-2026-58115 right now if you have it exposed to the web. This authentication bypass is bad. People are using it to dump Linux bots and webshells everywhere. It's happening.\n\n#vulnerability #phishing #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mzgs6nb7sc2d"}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-834709", "record": "SSA-834709", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-834709", "record": "SSA-834709", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-04T00:06:41.029Z", "date_only": false, "value": "2026-11-04T00:06:41.029004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzh2nm7zgk2e", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "2f131814-1345-4a30-854d-025bf44b79f4", "content": "Node-RED\u306bCVSS 10.0\u306e\u8106\u5f31\u6027(CVE-2026-58115)\u3001\u9060\u9694\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u72d9\u3046\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3092\u89b3\u6e2c\u3000Siemens\u88fd\u7523\u696d\u7528IoT\u6a5f\u5668\u306b\u3082\u5f71\u97ff \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mzh2nm7zgk2e"}, {"timestamp": "2026-11-04T00:53:38.913Z", "date_only": false, "value": "2026-11-04T00:53:38.913836Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/unnchain.bsky.social/post/3mzh5bn5ph32d", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "ec841517-b139-401c-ba0a-8e2b7ac3ede5", "content": "Siemens SIMATIC IoT2050 Advanced\uff08Industrial OS\u3067Node-RED\u3092\u5c0e\u5165\u3057\u305f\u6a5f\u5668\uff09\u306b\u3001CVE-2026-58115\uff08CVSS 10.0\uff09\u3002V4.3.4.1\u672a\u6e80\u306fNode-RED\u306eHTTP\u753b\u9762\u306b\u8a8d\u8a3c\u304c\u306a\u304f\u3001\u30ed\u30b0\u30a4\u30f3\u306a\u3057\u3067\u5916\u90e8\u304b\u3089\u30d5\u30ed\u30fc\u3092\u4f5c\u3089\u308c\u3001\u6700\u9ad8\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u304a\u305d\u308c\u3002V4.3.4.1\u4ee5\u964d\u3078\u66f4\u65b0\u3092\u3002\u305d\u308c\u307e\u3067\u306fNode-RED\u306e\u753b\u9762\u3092\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3084\u793e\u5185\u306e\u5e83\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304b\u3089\u5c4a\u304b\u306a\u3044\u3088\u3046\u306b\u3057\u3066\u304a\u304f\u3068\u5b89\u5fc3\u3002\nhttps://cert-portal.siemens.com/productcert/html/ssa-834709.html", "url": "https://bsky.app/profile/unnchain.bsky.social/post/3mzh5bn5ph32d"}, {"timestamp": "2026-11-04T02:10:42.565Z", "date_only": false, "value": "2026-11-04T02:10:42.565975Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3mzhblgsgwj2f", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "1774cf8c-a217-4df6-a2e9-8d3673d9ae46", "content": "SANS Stormcast Wednesday, November 4th, 2026: Refrigerator Defrost Attacks; Siemens SIMATIC Node-RED Exploited (CVE-2026-58115); cPGuard Update Channel Compromise; iPhone Lockdown Mode AirDrop Exploit\n https://isc.sans.edu/podcastdetail/10164", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3mzhblgsgwj2f"}, {"timestamp": "2026-11-04T02:52:04.195Z", "date_only": false, "value": "2026-11-04T02:52:04.195243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3mzhdvd4wfs2n", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "e0c7a543-620a-44cb-afcb-9fa2def1e0f5", "content": "Attackers exploit Node-RED flaw in Siemens SIMATIC IoT2050 gateways\n\nCVE-2026-58115, rated CVSS 10.0 and fixed in Industrial OS V4.3.4.1 in August, was used on 30 October to plant a Linux bot through the\u2026\n\n#infosec #cybersecurity #Munich #Germany #Manufacturing\ntrustlist.uk/security-advisorie\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3mzhdvd4wfs2n"}, {"timestamp": "2026-11-04T06:00:09Z", "date_only": false, "value": "2026-11-04T06:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108947", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9924b520-b41e-4a3a-9a87-10272d1a7551", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58115\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-04 05:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108947", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-04T06:00:09Z", "date_only": false, "value": "2026-11-04T06:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/108947", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "40191432-cbe7-43bd-8c89-b411e6e0031f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58115\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-04 05:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108947"}, {"timestamp": "2026-11-04T06:24:44.935Z", "date_only": false, "value": "2026-11-04T06:24:44.935874Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mzhprpfle42g", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "84b9f8fe-0e8d-4b0d-b408-82923a938ff7", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 3\n\u2022 CryptoPayment Gateway (plugin WordPress) (CVE-2026-81648), CVSS 10.0 (Hacktualit\u00e9s)\n\u2022 Node-RED (CVE-2026-58115), CVSS 10.0 (Cyberveille)\n\u2022 Barracuda Email Security Gateway (ESG) (CVE-2026-116606), CVSS 9.3 (Cyberveille Esant\u00e9)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mzhprpfle42g"}, {"timestamp": "2026-11-04T07:32:11.831Z", "date_only": false, "value": "2026-11-04T07:32:11.831209Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/axnews.bsky.social/post/3mzhtkce4ek2i", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "a70c54e2-a221-438c-a8b3-e23aab958949", "content": "\ud83d\udee1\ufe0f The CVEs that mattered \u00b7 Tuesday 3 November\n1. CVE-2026-116606 \u00b7 Critical 9.3 \u2014 Barracuda Email Security Gateway\u2026\n2. CVE-2026-58115 \u00b7 Critical 10.0 \u2014 Siemens SIMATIC IoT2050 Advanced\n3. CVE-2026-81648 \u00b7 Critical 10.0 \u2014 CryptoPayment Gateway\nhttps://ax-news.com/cve\n#CVE #infosec", "url": "https://bsky.app/profile/axnews.bsky.social/post/3mzhtkce4ek2i"}, {"timestamp": "2026-11-04T07:57:41.884Z", "date_only": false, "value": "2026-11-04T07:57:41.884205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mzhuxvo7mb2r", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "52b92365-0c4c-4ea5-ac67-00a8621646d4", "content": "Top 3 CVE for last 7 days:\nCVE-2026-98432: 621 interactions\nCVE-2026-109618: 66 interactions\nCVE-2026-111497: 66 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-98432: 59 interactions\nCVE-2026-58115: 12 interactions\nCVE-2026-58868: 11 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mzhuxvo7mb2r"}, {"timestamp": "2026-11-04T09:00:38.201Z", "date_only": false, "value": "2026-11-04T09:00:38.201128Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/73504b63-4d46-46b7-86ac-681210ae8220", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "0b12f956-1b65-430e-a06e-8b93fb4b51a8", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/73504b63-4d46-46b7-86ac-681210ae8220", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-04T10:31:26.170Z", "date_only": false, "value": "2026-11-04T10:31:26.170196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mzi5kstns52i", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "31d74979-4423-44f9-b122-6b1ec22a9e62", "content": "Max-severity Node-RED bug exploited for malware \ud83e\udd16\n\nA critical Node-RED vulnerability, CVE-2026-58115, is being exploited to deploy Linux bot malware, allowing unauthenticated remote code execution.\n\nThis max-severity bug in OT tools shows the escalating threat to industrial systems.", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mzi5kstns52i"}, {"timestamp": "2026-11-04T11:27:13.084Z", "date_only": false, "value": "2026-11-04T11:27:13.084515Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mziaok56z22r", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4e6711c2-0b4e-4e14-92e6-bfa12b225fe0", "content": "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors\n\nA maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.\n\nThe vulnerability, tracked as CVE-2026-58115 (CVSS sc\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mziaok56z22r"}, {"timestamp": "2026-11-04T13:02:45.969Z", "date_only": false, "value": "2026-11-04T13:02:45.969012Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/elcompilado.com/post/3mzifzfnpqq26", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "8de85dd7-01e6-4b2b-9cb6-360c29af5ee0", "content": "Briefing Tech \u2014 3 de noviembre de 2026\n\n\u2022 Meituan lanza LongCat-2.5: 1,6 billones de par\u00e1metros totales, multimodal nativo y\u2026\n\u2022 Nvidia les exige a sus socios de datacenter que al menos el 51% de los servicios\u2026\n\u2022 CVE-2026-58115: una falla de 10.0 en los Siemens SIMATIC IoT2050 se est\u00e1\u2026", "url": "https://bsky.app/profile/elcompilado.com/post/3mzifzfnpqq26"}, {"timestamp": "2026-11-04T17:45:30.430Z", "date_only": false, "value": "2026-11-04T17:45:30.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58115", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T17:45:30.430Z", "date_only": false, "value": "2026-11-04T17:45:30.430Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / siemens", "record": "CVE-2026-58115", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T17:48:41.413Z", "date_only": false, "value": "2026-11-04T17:48:41.413419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mzivyntw7c2r", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "69c1e5e8-8f57-4104-b2b0-1388121f00f6", "content": "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)\n\nAttackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprot\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mzivyntw7c2r"}, {"timestamp": "2026-11-04T18:17:45.050Z", "date_only": false, "value": "2026-11-04T18:17:45.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58115", "record": "FKIE_CVE-2026-58115", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-04T19:00:01Z", "date_only": false, "value": "2026-11-04T19:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-58115", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "73504b63-4d46-46b7-86ac-681210ae8220", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-04T19:15:12.118Z", "date_only": false, "value": "2026-11-04T19:15:12.118525Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzj2tdqat22o", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "78b50f34-a007-484c-a113-75cdde278dd5", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-119977 \u00b7 39 people \ud83d\udd25\n2. CVE-2026-98432 \u00b7 25 people\n3. CVE-2026-58868 \u00b7 18 people\n4. CVE-2026-58115 \u00b7 13 people\n5. CVE-2026-109518 \u00b7 9 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzj2tdqat22o"}, {"timestamp": "2026-11-04T19:15:13.988Z", "date_only": false, "value": "2026-11-04T19:15:13.988076Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzj2te3m422o", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "8bff2f25-d737-4074-b194-e3a0f3e5a1c3", "content": "4. CVE-2026-58115 \u00b7 13 people\n\ud83d\udfe5 Critical 10.0 \u00b7 Siemens SIMATIC IoT2050 Advanced\n\nA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed).", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mzj2te3m422o"}], "metrics": {"as_of": "2026-11-05T00:48:18.455Z", "anchors": {"origin": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-11-04T06:00:09Z", "date_only": false, "value": "2026-11-04T06:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108947", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9924b520-b41e-4a3a-9a87-10272d1a7551", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58115\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-04 05:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108947", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-11-03T05:52:04Z", "date_only": false, "value": "2026-11-03T05:52:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10542", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4d35a20d-7db3-4b6a-924c-2df433353c6a", "content": "\ud83d\udea8 Critical Siemens IoT2050 flaw under active exploitation.\n\nAttackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.\n\nVulnCheck captured the exploit attempts on its honeypots.\n\nHow the attacks work \u2193 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://t.me/thehackernews/10542", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 7278724.0, "hours": 2021.8677777777777, "days": 84.24449074074074, "min_seconds": 7192324.0, "max_seconds": 7278724.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-03T05:52:04Z", "date_only": false, "value": "2026-11-03T05:52:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10542", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4d35a20d-7db3-4b6a-924c-2df433353c6a", "content": "\ud83d\udea8 Critical Siemens IoT2050 flaw under active exploitation.\n\nAttackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.\n\nVulnCheck captured the exploit attempts on its honeypots.\n\nHow the attacks work \u2193 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://t.me/thehackernews/10542", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 7278724.0, "hours": 2021.8677777777777, "days": 84.24449074074074, "min_seconds": 7192324.0, "max_seconds": 7278724.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-03T05:52:04Z", "date_only": false, "value": "2026-11-03T05:52:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10542", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4d35a20d-7db3-4b6a-924c-2df433353c6a", "content": "\ud83d\udea8 Critical Siemens IoT2050 flaw under active exploitation.\n\nAttackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.\n\nVulnCheck captured the exploit attempts on its honeypots.\n\nHow the attacks work \u2193 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://t.me/thehackernews/10542", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 7365609.0, "hours": 2046.0025, "days": 85.25010416666667, "min_seconds": 7279209.0, "max_seconds": 7365609.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T06:00:09Z", "date_only": false, "value": "2026-11-04T06:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108947", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9924b520-b41e-4a3a-9a87-10272d1a7551", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58115\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-04 05:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108947", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 7433298.455037, "hours": 2064.8051263991665, "days": 86.03354693329861, "min_seconds": 7346898.455037, "max_seconds": 7433298.455037, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-11T00:00:00Z", "date_only": false, "value": "2026-08-11T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-26-237-03", "record": "ICSA-26-237-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-05T00:48:18.455Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 154574.455037, "hours": 42.93734862138889, "days": 1.7890561925578705, "min_seconds": 154574.455037, "max_seconds": 154574.455037, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T05:52:04Z", "date_only": false, "value": "2026-11-03T05:52:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10542", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "4d35a20d-7db3-4b6a-924c-2df433353c6a", "content": "\ud83d\udea8 Critical Siemens IoT2050 flaw under active exploitation.\n\nAttackers are abusing CVE-2026-58115 (CVSS 10.0) to push Linux bot payloads and create remote command backdoors via Node-RED.\n\nVulnCheck captured the exploit attempts on its honeypots.\n\nHow the attacks work \u2193 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html", "url": "https://t.me/thehackernews/10542", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-05T00:48:18.455Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 67689.455037, "hours": 18.80262639916667, "days": 0.7834427666319446, "min_seconds": 67689.455037, "max_seconds": 67689.455037, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-04T06:00:09Z", "date_only": false, "value": "2026-11-04T06:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/108947", "record": "CVE-2026-58115", "field": "creation_timestamp", "uuid": "9924b520-b41e-4a3a-9a87-10272d1a7551", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-58115\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-04 05:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-58115: Siemens SIMATIC IoT2050 Node-RED unauthenticated root RCE. PoC, scanner, PCAP, detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/108947", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-05T00:48:18.455Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}