Critical Unauthenticated RCE Vulnerability in Orkes Conductor Actively Exploited in the Wild

Cybersecurity researchers and threat intelligence firms have issued urgent warnings regarding a critical, actively exploited vulnerability impacting Orkes Conductor, a widely utilized cloud orchestration and microservices workflow automation platform. The security flaw, tracked as CVE-2026-58138, carries a maximum severity rating of 9.8 on the CVSS v3.1 scale and a 9.3 on the CVSS v4 framework, reflecting its capacity for severe enterprise disruption.

According to advisory details released by the National Vulnerability Database (NVD) and prominent cybersecurity vendors, the vulnerability stems from a case of unauthenticated remote code execution. Specifically, versions of Orkes Conductor from 3.21.21 prior to 3.30.2 contain a critical flaw that allows remote, unauthenticated attackers to execute arbitrary operating system commands. This is achieved by submitting inline workflow definitions containing malicious JavaScript or Python expressions directly to the platform’s workflow API endpoint prior to any authentication checks.

The mechanics of the vulnerability heavily involve unsandboxed GraalVM evaluators configured inappropriately with HostAccess.ALL or allowAllAccess(true). When leveraged through specific workflow task types—including INLINE, LAMBDA, DO_WHILE, and SWITCH—untrusted actors can utilize Java reflection or direct subprocess calls to break out of the intended execution environment. Because these vulnerable evaluators are configured with unrestricted host access, attackers can successfully escape the sandboxed scripting environment and execute arbitrary operating system commands with the exact privileges held by the underlying Conductor process.

In an outbreak alert published this week, security giant Fortinet revealed that it has observed malicious actors actively targeting vulnerable Orkes Conductor servers in the wild. The attackers are reported to be exploiting CVE-2026-58138 by transmitting carefully crafted workflow definitions containing malicious JavaScript or Python expressions to the Conductor workflow API, successfully achieving remote code execution without needing valid credentials.

The scope and scale of the automated exploitation attempts underscore the urgency of the threat. Telemetry data compiled by Fortinet demonstrates a sharp escalation in malicious activity targeting the flaw. As of September 9, 2026, the security firm reported blocking a staggering 1,290 attack attempts within a single 24-hour window, marking a 132% surge in daily exploitation activity. Looking across a slightly broader timeframe, Fortinet’s systems intercepted nearly 7,000 distinct attack attempts between September 2 and September 9, 2026. Geographical telemetry indicates that the majority of this aggressive scanning and attack traffic originated from sources located in Germany, Hong Kong, Indonesia, the United Arab Emirates, and India.

Additional intelligence from independent cybersecurity organizations corroborates the timeline of real-world exploitation. Telemetry data shared by Previdian indicates that early exploitation attempts against its network honeypots were recorded as early as July 24, 2026, originating from two distinct IP addresses located in France and the United States. Furthermore, researchers at Empirical Security documented independent detections of in-the-wild exploitation attempts targeting the vulnerability as recently as August 21, 2026, proving that malicious actors have incorporated CVE-2026-58138 into their active campaign arsenals for months.

Given the active exploitation of CVE-2026-58138 and the high severity of unauthenticated remote code execution, software maintainers and security analysts strongly urge organizations utilizing affected versions of Orkes Conductor to apply patches immediately. The developers have addressed the underlying architectural flaw in Conductor version 3.30.2. System administrators and enterprise security teams running vulnerable deployments are advised to upgrade to Conductor 3.30.2 or any subsequent release as soon as possible to neutralize the threat vector.

For organizations where immediate patching is operationally unfeasible, security professionals recommend implementing robust compensating controls. These defensive measures include restricting external, unauthenticated access to Conductor workflow API endpoints, placing sensitive Conductor instances securely behind strict network access controls or internal-only perimeters, and deploying heightened monitoring solutions to detect anomalous workflow submissions, unexpected child processes, or unauthorized command execution on host systems.