VulnCheck reports that a critical vulnerability (CVSS 10.0) affecting Siemens SIMATIC IoT2050 Advanced devices is under active exploitation. The flaw, tracked as CVE-2026-58115, involves missing authentication for a critical function, allowing unauthenticated remote attackers to run arbitrary code and potentially plant remote command backdoors. The vulnerability impacts industrial control and automation environments globally. No official patch has been mentioned; affected organizations are advised to monitor Siemens security advisories and implement network segmentation as an interim measure.

What should defenders do?

Affected organizations should monitor Siemens security advisories for firmware updates and apply available patches. As interim measures, network segmentation and strict access controls are recommended to limit unauthenticated remote access to affected devices. Organizations should also review and harden network configurations surrounding SIMATIC IoT2050 units.

criticalcybersecurity

Active Exploitation of Maximum-Severity Siemens IoT2050 Authentication Bypass Flaw

Unauthenticated remote attackers exploiting CVE-2026-58115 to execute arbitrary code on SIMATIC IoT2050 Advanced devices

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

Active Exploitation of Maximum-Severity Siemens IoT2050 Authentication Bypass Flaw

Key Takeaways

Critical vulnerability CVE-2026-58115 (CVSS 10.0) in Siemens SIMATIC IoT2050 Advanced devices is under active exploitation.
The flaw involves missing authentication for a critical function, allowing unauthenticated remote code execution.
Affected devices are used in industrial control and automation environments globally.

Related Security News

highCVE

CISA Adds Two Ivanti Connect Secure Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026, based on evidence of active exploitation. Both affect Ivanti Connect Secure and are subject to remediation requirements under Binding Operational Directive 26-04 for federal agencies.

CISA Advisoriesabout 1 hour ago1 min read