Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.
Fortinet reports active in-the-wild exploitation of CVE-2026-58138 (CVSS v3.1 9.8), an unauthenticated remote code execution flaw in Orkes Conductor 3.21.21 before 3.30.2. Attackers submit inline workflow definitions with malicious JavaScript or Python expressions to the workflow API, escaping unsandboxed GraalVM evaluators configured with HostAccess.ALL to run arbitrary OS commands. Fortinet blocked 1,290 attempts in 24 hours as of September 9, 2026, and nearly 7,000 between September 2-9, with most activity from Germany, Hong Kong, Indonesia, the U.A.E., and India. Previdian and Empirical Security also observed exploitation since July 24, 2026.
- Pre-auth RCE via malicious JavaScript/Python in inline workflow definitions
- Exploits unsandboxed GraalVM evaluators with allowAllAccess(true) in INLINE, LAMBDA, DO_WHILE, SWITCH tasks
- 132% daily increase in attacks; ~7,000 attempts blocked in one week
- Fix in Conductor 3.30.2; restrict workflow API access if patching is delayed
- CVEs
- CVE-2026-58138
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.007 JavaScript/JScriptT1059.006 PythonT1059 Command and Scripting Interpreter
- Products
- Orkes ConductorGraalVM
- Organizations
- FortinetPrevidianEmpirical Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58138 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS… | 9.3 | 9% | PoC |
From the original article
2 min read at thehackernews.com
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3. 1 score: 9.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.