Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138, with a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, relating to an unauthenticated remote code execution (RCE) flaw.

Vulnerability Details

Orkes Conductor versions 3.21.21 through 3.30.1 contain an unauthenticated remote code execution vulnerability. As described in the NIST National Vulnerability Database (NVD):

"Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication."

The flaw enables attackers to exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types. This allows invocation of arbitrary system commands via Java reflection or direct subprocess calls.

Exploitation in the Wild

Fortinet has observed attackers actively targeting Orkes Conductor servers vulnerable to CVE-2026-58138. In an outbreak alert, the company reported that attackers submit crafted workflow definitions containing JavaScript or Python expressions to the Conductor workflow API. According to Fortinet:

"Because vulnerable evaluators can be configured with unrestricted host access, the attacker can escape the intended scripting environment and execute arbitrary operating system commands with the privileges of the Conductor process."

Attack Statistics

• September 9, 2026: Fortinet blocked 1,290 attack attempts within 24 hours, representing a 132% increase in daily activity.
• September 2-9, 2026: Nearly 7,000 attempts were blocked.
• Geographic distribution: The majority of attack activity originated from Germany, Hong Kong, Indonesia, the U.A.E., and India.
• Honeypot telemetry: Previdian recorded three exploitation attempts against its honeypots since July 24, 2026, from two unique IP addresses in France and the U.S.
• Empirical Security detected in-the-wild exploitation as recently as August 21, 2026.

Mitigation Recommendations

Organizations using affected versions should upgrade to Orkes Conductor 3.30.2 or later, which addresses the vulnerability. If immediate patching is not feasible, the following measures are recommended:

• Restrict external access to Conductor workflow API endpoints.
• Place Conductor instances behind appropriate network access controls.
• Monitor for suspicious workflow submissions and unexpected command execution.