A critical vulnerability affecting Orkes Conductor workflow platform is being actively exploited by attackers, according to cybersecurity firm Fortinet. The vulnerability, tracked as CVE-2026-58138, allows unauthenticated remote code execution and has received a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, making it a high priority security issue for organizations using affected versions. Security researchers have observed attempts targeting vulnerable Orkes Conductor servers, highlighting the importance of applying available security updates and reviewing exposed workflow API endpoints.
The flaw affects Orkes Conductor versions 3.21.21 before 3.30.2 and is linked to the platform’s handling of workflow definitions containing malicious JavaScript or Python expressions. According to information published in the National Vulnerability Database (NVD), remote attackers can exploit the vulnerability by submitting specially crafted inline workflow definitions to the workflow API endpoint without authentication. The issue involves unsandboxed GraalVM evaluators configured with unrestricted host access settings, including HostAccess.ALL or allowAllAccess(true). Through certain workflow task types such as INLINE, LAMBDA, DO_WHILE, and SWITCH, attackers may be able to execute operating system commands through Java reflection or direct subprocess calls.
Fortinet reported that attackers are actively targeting vulnerable Orkes Conductor deployments by submitting malicious workflow definitions containing JavaScript or Python expressions. The security company explained that because vulnerable evaluators may operate with unrestricted host access, attackers can escape the intended scripting environment and execute arbitrary commands with the same privileges available to the Conductor process. Fortinet’s monitoring data showed a significant increase in exploitation activity, with the company blocking 1,290 attack attempts within a 24-hour period as of September 9, 2026. This represented a 132% increase in daily activity, while nearly 7,000 exploitation attempts were blocked between September 2 and September 9. According to Fortinet, much of the observed activity originated from locations including Germany, Hong Kong, Indonesia, the United Arab Emirates, and India.
Additional security monitoring has also identified exploitation attempts linked to CVE-2026-58138. Telemetry data from Previdian showed three exploitation attempts against its honeypots since July 24, 2026, originating from two unique IP addresses located in France and the United States. Empirical Security also reported detecting exploitation activity in the wild as recently as August 21, 2026. These observations indicate that attackers are actively searching for vulnerable Orkes Conductor installations and attempting to take advantage of exposed systems. Organizations using affected versions of Orkes Conductor are advised to upgrade to version 3.30.2 or later, which includes fixes for the vulnerability. For environments where immediate patching is not possible, security teams are recommended to limit external access to Conductor workflow API endpoints, implement appropriate network access controls, and monitor for unusual workflow submissions or unexpected command execution activity. The vulnerability highlights the security risks associated with workflow automation platforms that process user-controlled scripts and reinforces the need for strong access controls, regular patching, and continuous monitoring across enterprise technology environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
