“Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication,” the NIST National Vulnerability Database warns.
Fortinet: 1,290 attack attempts blocked in 24 hours
Security vendor Fortinet reported an outbreak of active exploitation targeting Orkes Conductor instances vulnerable to CVE-2026-58138. In an alert issued this week, Fortinet said it had blocked 1,290 attack attempts within a single 24-hour period as of September 9, 2026, a daily activity increase of 132 percent. Between September 2 and September 9, Fortinet blocked nearly 7,000 attempts. The company attributed the bulk of observed traffic to origins in Germany, Hong Kong, Indonesia, the U.A.E., and India.
The flaw: CVE-2026-58138 and unsandboxed GraalVM evaluators
The vulnerability, tracked as CVE-2026-58138 and scored 9.8 by CVSS v3.1 (9.3 by CVSS v4), permits unauthenticated remote code execution. The NVD description states that attackers can submit workflow definitions containing malicious JavaScript or Python to the Conductor workflow API “prior to authentication.” The NVD further explains: “Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleObserved exploitation: Previdian and Empirical Security telemetry
Independent telemetry corroborates in-the-wild activity. Previdian recorded three exploitation attempts against its honeypots since July 24, 2026, originating from two unique IP addresses in France and the U.S. Empirical Security reported detecting exploitation as recently as August 21, 2026. Fortinet’s outbreak alert and these third-party detections together indicate that attackers are submitting crafted workflow definitions to Conductor’s workflow API endpoints to trigger code execution.
Mitigations: upgrade, isolate, and monitor
The immediate technical remedy is an upgrade: organizations using affected versions are advised to move to Conductor 3.30.2 or later, which addresses the vulnerability. For environments where immediate patching is not feasible, the published guidance recommends restricting external access to Conductor workflow API endpoints, placing Conductor instances behind appropriate network access controls, and monitoring for suspicious workflow submissions and unexpected command execution. Fortinet’s alert highlights that, because vulnerable evaluators can be configured with unrestricted host access, a successful exploit can execute arbitrary operating system commands with the privileges of the Conductor process.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: prioritize identifying Conductor instances running versions earlier than 3.30.2, audit evaluator configurations for HostAccess.ALL or allowAllAccess(true), and implement network controls to limit API exposure while planning upgrades.
- Affected enterprises and procurement leaders: inventory externally accessible workflow API endpoints and factor timely vendor patching and configuration hardening into procurement and operational risk assessments.
- Adversaries and threat actors: the public telemetry and Fortinet blocks show active exploitation techniques relying on crafted inline JavaScript and Python in workflow definitions — a pattern attackers are using in the wild and that defenders must watch for in logs and telemetry.
The combination of a high-severity CVE (CVE-2026-58138), documented unsandboxed evaluator modes, and multiple, recent in-the-wild detections makes this a clear operational priority for any organization running Orkes Conductor prior to version 3.30.2. Upgrade where possible; where not, harden network exposure to the workflow API and watch for the specific indicators described above. For the full advisory and Fortinet’s outbreak details, see the original story:
https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
