Orkes Conductor RCE: CVE-2026-58138 exploited, patch now

A critical security flaw in the Orkes Conductor workflow platform, tracked as CVE-2026-58138, is being exploited in the wild, and a fixed version is available. The vulnerability scores 9.8 under the CVSS v3.1 rating system and 9.3 under CVSS v4, both at the top of the severity scale; a CVSS score is a standard number that rates how serious a technical weakness is, and anything close to 10 is treated as critical. According to Fortinet, which issued an outbreak alert this week, attackers are actively targeting Orkes Conductor servers that have not been updated. Versions from 3.21.21 up to but not including 3.30.2 are affected, and the fix is to move to Conductor 3.30.2 or later.

The weakness is a case of unauthenticated remote code execution. Unauthenticated means an attacker needs no account, password or logged-in session to abuse it, and remote code execution means they can make the software run commands of their own choosing. A workflow platform is software that chains individual tasks into an automated sequence, and Orkes Conductor exposes a programming interface, an API, that other programs use to submit those workflows. The description published in the NIST National Vulnerability Database sets out the mechanism: an attacker submits an inline workflow definition containing malicious JavaScript or Python expressions to the workflow API endpoint before authenticating, and because the evaluators that run those expressions, GraalVM evaluators, are configured with no sandbox and with full host access (settings known as HostAccess.ALL or allowAllAccess(true)), the expressions are not held inside a safe boundary. A sandbox is a restricted space where code is supposed to run without reaching the rest of the system. The entry names four task types through which the flaw can be reached, INLINE, LAMBDA, DO_WHILE and SWITCH, and says an attacker can invoke arbitrary system commands either through Java reflection, a feature that lets code call other code it should not normally be able to touch, or by starting a subprocess directly.

Fortinet said it observed attackers submitting crafted workflow definitions containing JavaScript or Python expressions to the Conductor workflow API. Because vulnerable evaluators can be configured with unrestricted host access, the attacker can escape the intended scripting environment and execute arbitrary operating system commands with the privileges of the Conductor process, the company said. In practice that means the commands run with whatever access the Conductor service holds on the machine. Fortinet's figures show how intense the campaign became: as of September 9, 2026, it had blocked 1,290 attack attempts within a 24 hour span, which it described as a 132 percent increase in daily activity, and nearly 7,000 attempts were blocked between September 2 and September 9, 2026. Fortinet said the majority of the activity originated from Germany, Hong Kong, Indonesia, the United Arab Emirates and India.

Other security teams have seen the same exploitation from different vantage points. Previdian reported telemetry showing three exploitation attempts against its honeypots since July 24, 2026, from two unique IP addresses in France and the United States; a honeypot is a deliberately exposed system that does no real work and exists only to record what attackers try to do to it. Empirical Security said it detected in-the-wild exploitation as recently as August 21, 2026. Together, the three sets of observations indicate a flaw that is being probed and used now, not one that exists only on paper.

The published guidance is to upgrade to Conductor 3.30.2 or later, which addresses CVE-2026-58138. Where an immediate patch is not an option, the recommendations are to restrict external access to Conductor workflow API endpoints, place Conductor instances behind appropriate network access controls, and monitor for suspicious workflow submissions and unexpected command execution. Those last steps matter because an automation platform is exactly the kind of system that should not be reachable from the open internet by anyone who happens to find it: if the API is available only to the networks and services that genuinely need it, the room for abuse shrinks considerably. Monitoring for unexpected command execution is also the check that would surface misuse of this particular flaw, which is why the advisory pairs it with the upgrade instruction rather than treating it as optional.

For the IT teams and providers who run platforms of this kind, knowing what is exposed to the internet and how quickly a vendor fix is installed is the everyday part of the job, and that is where a service such as AEU-I, which covers security-focused IT, infrastructure and consulting, fits in for organisations that want a second pair of eyes on what their systems publish to the outside world. The wider point from this case is that an authentication step in front of a service offers no protection when the flaw can be triggered before that step is ever reached, and that the only reliable remedy named in the advisory is the updated release.

There is no ambiguity about the risk here: the version range is published, the fixed release is published, and independent monitoring teams have recorded live attack traffic against the flaw. Orkes Conductor operators who have not yet moved to 3.30.2 remain in the affected range described by the National Vulnerability Database.