# Critical Siemens IoT2050 and CryptoPayment Gateway flaws face active exploitation

*Tuesday, November 3, 2026 at 6:11 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-03T06:11:40.208Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22316.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are exploiting CVE‑2026‑58115 in Siemens’ IoT2050 devices and targeting CVE‑2026‑81648 in a CryptoPayment Gateway WordPress plugin, both rated CVSS 10.0 and capable of enabling remote control or payment theft.

Two separate vulnerabilities, each rated at the maximum 10.0 on the CVSS severity scale, are drawing active exploitation attempts against both industrial and web‑based systems.

Security firm VulnCheck reports that attackers are abusing CVE‑2026‑58115 in Siemens IoT2050 devices. These units act as industrial and IoT gateways. According to VulnCheck, attackers are using the flaw to push Linux bot payloads and create remote command backdoors via the Node‑RED environment on these devices.

Once a backdoor is in place on an IoT2050 gateway, an attacker can run commands remotely and potentially use the compromised device as a foothold inside operational networks or as part of a botnet.

In a separate campaign, attackers are targeting an unpatched flaw in the CryptoPayment Gateway WordPress plugin, tracked as CVE‑2026‑81648 and also rated CVSS 10.0. The plugin handles cryptocurrency payments.

The vulnerability allows unauthenticated attackers to extract wallet credentials, delete server files and overwrite payment settings. Those capabilities create a direct risk of stolen funds, corrupted sites and hijacked payment flows.

There is currently no known fix for CVE‑2026‑81648. Exploitation attempts have already been observed in the wild, increasing the urgency for site operators using the plugin to take protective action, including disabling it.

The Siemens IoT2050 vulnerability is also under active exploitation, with honeypots already capturing attempts to compromise devices exposed to the internet.

For defenders, the immediate priorities are to identify any exposed Siemens IoT2050 hardware, monitor Node‑RED activity and network traffic for signs of compromise, and review WordPress sites for use of the vulnerable CryptoPayment Gateway plugin.

Further developments to watch include vendor guidance or patches for affected products, changes in attacker behavior as exploits become more widely known and any evidence that these footholds are being used for larger campaigns against industrial networks or cryptocurrency payment infrastructure.