Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Summary: Fortinet reports active exploitation of CVE-2026-58138, an unauthenticated remote code execution flaw in Orkes Conductor versions 3.21.21 before 3.30.2, rated 9.8 on CVSS v3.1 and 9.3 on v4. Attackers submit crafted workflow definitions with malicious JavaScript or Python expressions to the Conductor workflow API before authentication, using unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) to run arbitrary OS commands with the Conductor process's privileges.
Key Takeaway: Fortinet blocked 1,290 attack attempts in 24 hours as of September 9, 2026, a 132% increase in daily activity, and nearly 7,000 attempts between September 2 and 9, with most traffic originating from Germany, Hong Kong, Indonesia, the U.A.E., and India.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-58138
- Related
- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026