Node-RED was not exploited: they sent it three nodes
On 30 October a VulnCheck canary caught the attack against CVE-2026-58115, a CVSS 10.0 in the Node-RED interface. What arrived was a three-node flow with an exec node in it: the tool doing its job for someone who never had to supply a password. We walk through what the route they used actually does, why the ten scores a documented setting rather than a coding flaw, the identical 2025 precedent nobody has cited, and the automation census almost nobody has written down.
Microsoft 365
ES 
CAT 
EN