Critical Vulnerability in Orkes Conductor: Unauthenticated RCE Exploited in Real-World Attacks

Fortinet has warned of active exploitation of a critical vulnerability in Orkes Conductor — a platform for workflow orchestration. The issue has been assigned the identifier CVE-2026-58138 and the highest possible severity scores: 9.8 on CVSS v3.1 and 9.3 on CVSS v4.

What it's about

The vulnerability belongs to the class of unauthenticated remote code execution (pre-auth RCE). According to the description in the NVD database, it affects versions of Orkes Conductor from 3.21.21 up to 3.30.2. An attacker can send an inline workflow definition to the workflow API containing malicious JavaScript or Python expressions — all of this before authentication even takes place.

The root of the problem lies in unsecured GraalVM-based expression evaluators configured with the HostAccess.ALL or allowAllAccess(true) parameters. Through the INLINE, LAMBDA, DO_WHILE, and SWITCH task types, an attacker is able to break out of the intended scripting sandbox and execute arbitrary system commands — using Java reflection or direct subprocess calls. The commands run with the privileges of the Conductor process.

The scale of the attacks

According to Fortinet, in the single day leading up to September 9, 2026, 1,290 attack attempts were blocked — 132% more than the day before. Between September 2 and 9, the company fended off nearly 7,000 attempts. The main sources of activity were Germany, Hong Kong, Indonesia, the UAE, and India.

Related data confirms that interest in the vulnerability did not emerge yesterday. Previdian telemetry recorded three exploitation attempts against honeypots as far back as July 24, 2026 — from two IP addresses in France and the United States. Empirical Security noted attacks in the wild through August 21, 2026.

What to do

Organizations using vulnerable versions are advised to upgrade to Conductor 3.30.2 or newer, where the flaw has been fixed, as soon as possible. If an immediate upgrade is not feasible, it is worth restricting external access to the workflow API, placing Conductor instances behind network access control measures, and closely monitoring for suspicious workflow definitions and unexpected command execution.

Source: The Hacker News