Two perfect scores, two very different blast radiuses
The working headline is simple because the story is simple: CVSS 10 flaws face active attacks. In the last 72 hours, researchers and security media have documented exploitation of two maximum-severity vulnerabilities that sit in very different parts of the technology stack: Siemens SIMATIC IoT2050 Advanced devices used around industrial environments, and a WordPress cryptocurrency-payment plugin used by online stores . One path points toward remote command execution on an industrial gateway; the other points toward exposed wallet credentials and payment-configuration tampering .
The overlap matters. These are not merely “critical” bugs in the abstract. Both are unauthenticated paths into functions that should have been tightly controlled: Node-RED flows capable of executing commands on a Siemens-connected system, and WordPress plugin operations able to read or overwrite payment settings . That is why the CVSS 10.0 rating feels less like a theoretical score and more like a warning label.
Siemens IoT2050: Node-RED becomes the attack surface
VulnCheck said one of its canaries caught exploitation of CVE-2026-58115 on October 30, 2026, describing it as an unauthenticated Node-RED admin API flaw being used to deploy a flow that downloads and runs a Linux bot . The company said the request came from an IP address in Microsoft’s AS8075 network and that it later saw 16 events from the same IP against the same CVE, with several payload variants .
The vulnerability is tied to Siemens SIMATIC IoT2050 Advanced systems, where Node-RED is embedded in a product class that often bridges information technology and operational technology . VulnCheck summarized the core failure clearly: CVE-2026-58115 allows unauthenticated access to programming nodes that can execute system commands on the server . The Hacker News, citing Siemens’ advisory, reported that the flaw affects SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed and allows an unauthenticated remote attacker to create malicious flows and execute arbitrary code with maximum privileges .
That combination is dangerous because Node-RED is designed to make event-driven automation easy. VulnCheck noted that an “inject” node can fire a message on startup or a schedule, while an “exec” node can run a shell command; when wired together, the flow can execute a command as soon as it is deployed . In a benign environment, that is useful automation. In an exposed and unauthenticated environment, it is remote command execution with a user-friendly interface.
What the Siemens exploitation looked like
The Siemens exploitation observed by VulnCheck was not a vague scan. The company described the request as a complete exploit that deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server behind three layers of encoding . The initial attack used a shell wrapper to fetch an AMD64 Linux bot, save it in memory-backed storage as /dev/shm/.b, and execute it .
The campaign also evolved. Reporting on VulnCheck’s findings says the attackers later shifted toward a two-stage process using wget to retrieve another shell script named wget.sh from the same server . Another request reportedly tried to fetch a payload named .sys_update, save it as /tmp/.kworker, and run it under a name that resembles a kernel worker thread . VulnCheck said it did not retrieve or analyze the bot binary itself, so the malware’s final capabilities remain unconfirmed .
The most worrying variant may be the simplest. Some requests reportedly did not deploy a downloader; instead, they exposed an HTTP endpoint such as /cmd and wired it to an exec node so the attacker could run commands later through a query parameter . That pattern turns a one-time exploit into a backdoor-like control channel, which is especially concerning on devices that may sit near production networks.
Industrial risk is not limited to one box
For defenders, CVE-2026-58115 should be treated as more than a Siemens device issue. The IoT2050 is an industrial gateway category product, and VulnCheck emphasized that Node-RED is used across manufacturing, utilities, healthcare, agriculture, home automation, and industrial automation . The problem is not that every Node-RED deployment is affected by this Siemens CVE; the problem is that the same “low-friction automation” model becomes high-risk when exposed without authentication.
The immediate response is clear. The Hacker News reported that the Siemens issue has been remediated in versions 4.3.4.1 or later . Where updating is not immediately possible, the same report says Siemens recommends uninstalling Node-RED or hardening the installation by enabling HTTPS, protecting the editor and admin API with credential-based authentication or OAuth/OpenID, and securing HTTP nodes and the Node-RED Dashboard with basic authentication .
CryptoPayment Gateway: a small plugin with direct money exposure
The second active exploitation case sits in a very different environment: WordPress. Defused said it was observing in-the-wild exploitation attempts against CVE-2026-81648, a critical CVSS 10.0 flaw in CryptoPayment Gateway for WordPress . The company said there had been no prior public report of exploitation in the wild, and that the vulnerability lets anyone read stored payment-gateway settings, including wallet credentials held in cleartext, and overwrite the configuration .
The Hacker News reported that the flaw affects CryptoPayment Gateway versions 1.2.1 through 1.2.2, with 1.2.2 described as the latest version and no known fix available . The same report said the plugin had been closed on the WordPress Plugin Directory as of August 28, 2026, due to an unspecified security issue, and that public statistics showed 1,845 total downloads, including 20 in the previous seven days .
A small download count does not make the bug harmless. CryptoPayment Gateway is a WooCommerce extension that lets WordPress stores accept cryptocurrency payments after the store owner adds wallet addresses to the plugin’s settings . If those settings can be read or overwritten by an unauthenticated attacker, the impact is not merely website defacement; it can become payment diversion, credential exposure, and loss of trust at checkout.
The WordPress flaw changes the payment path
The technical pattern behind CVE-2026-81648 is missing authorization on an AJAX endpoint, allowing unauthenticated administrative operations . According to current reporting, exploitation can include deleting arbitrary server files, overwriting payment-gateway configuration, and recovering stored wallet credentials in cleartext . Crypto Times also identified admin-ajax.php as the relevant endpoint path and reported that the flaw stems from a missing authorization check .
Defused said the attacks it recorded came from infrastructure marketed as “Anonymous KYC-Free VPS Hosting” . That detail should not be overread as attribution, but it does suggest the exploitation is operational rather than purely academic. The public evidence supports active attempts and credential exposure risk; it does not establish that cryptocurrency theft has already occurred.
The advice is correspondingly direct. In the absence of a patch, site owners should remove the plugin, rotate wallet keys or credentials, and audit for suspicious changes . For stores that used the plugin, checking configured wallet addresses against known-good records is just as important as checking server logs, because a quiet payment-address change can be more damaging than a noisy intrusion.
The bigger pattern: default trust keeps losing
These two cases should not be collapsed into one technical category. Siemens IoT2050 exploitation is about unauthenticated control of automation logic on an industrial gateway; CryptoPayment Gateway exploitation is about unauthenticated access to payment secrets and configuration inside WordPress . Yet both failures share a root cause that defenders keep meeting in different disguises: privileged functions reachable without the proof of identity or authorization they deserve.
That is why “CVSS 10” should not be treated as just another dashboard color. In these cases, the perfect score maps to real-world exploitability: no credentials needed, sensitive function exposed, and attackers already testing or using the path . The practical priority is not to debate severity; it is to find exposed Node-RED interfaces, update or harden Siemens IoT2050 systems, remove the vulnerable WordPress plugin, rotate secrets, and verify that payment and command paths have not been quietly altered .
Default trust remains the final boss in industrial security and plugin security alike. This week, attackers found two doors where there should have been locks.
Comments
Be the first to comment.