A major vulnerability affecting the Orkes Conductor platform is currently being exploited in real-world scenarios, as reported by Fortinet. This vulnerability, identified as CVE-2026-58138, has been assigned a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, indicating its critical nature. It allows unauthenticated remote code execution, posing a significant threat to affected systems.
Details of the Vulnerability
The flaw exists in Orkes Conductor versions 3.21.21 and earlier than 3.30.2. It enables remote attackers to execute arbitrary operating system commands by submitting malicious JavaScript or Python code through the workflow API endpoint before authentication. The vulnerability leverages unsandboxed GraalVM evaluators that can be configured with unrestricted host access, facilitating command execution via Java reflection or direct subprocess calls.
Exploitation in the Wild
Fortinet has issued an outbreak alert, noting active exploitation attempts against vulnerable Orkes Conductor servers. Attackers craft workflow definitions containing malicious scripts to target the workflow API. This has led to attackers gaining the ability to execute arbitrary system commands with the privileges of the Conductor process.
As of September 9, 2026, Fortinet blocked 1,290 attack attempts in a single day, marking a 132% increase in daily attacks. Over 7,000 attempts were thwarted from September 2 to 9, 2026, with most originating from Germany, Hong Kong, Indonesia, the U.A.E., and India.
Protective Measures
Security firms like Previdian and Empirical Security have also observed exploitation attempts, with incidents reported as early as July 24, 2026. Organizations using affected software versions should urgently upgrade to Conductor 3.30.2 or later, which mitigates the vulnerability. For those unable to apply the update immediately, restricting external access to the Conductor workflow API, placing instances behind secure network controls, and monitoring for suspicious activity are recommended precautions.
In conclusion, the critical Orkes Conductor vulnerability poses a severe security risk. It is essential for organizations to implement effective measures and updates to safeguard their systems against potential exploitation and mitigate the impact of these attacks.
