Reported by 10 outlets

Timeline

1. original reporting

   Critical Orkes Conductor Vulnerability Exploited in Attacks

   securityweek.com · 25d ago · September 18th, 2026

   A critical-severity vulnerability in Orkes Conductor that can be exploited without authentication has been in attackers’ crosshairs for at least a month. Conductor is an open source unified enterprise framework that allows organizations to orchestrate microservices, workflows, and AI agents. Tracked as CVE-2026-58138 (CVSS score of 9.8), the critical bug is described as a remote code execution issue exploitable via inline workflow definitions submitted to the workflow API endpoint. Attackers can include malicious JavaScript or Python expressions in the definitions to invoke arbitrary system commands. The flaw affects how Conductor runs scripts inside a workflow. “An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL,” Empirical Security explains . This configuration disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges. “No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it,” Empirical notes. CVE-2026-58138 was patched in June in Orkes Conductor version 3.30.2. Proof-of-concept (PoC) code targeting it was

2. update from cyberworldops.eu

   Orkes Conductor 3.21.21 through before 3.30.2 is affected by CVE-2026-58138, an unauthenticated RCE via malicious workflow definitions using

   cyberworldops.eu · 25d ago · September 18th, 2026

   Orkes Conductor 3.21.21 through before 3.30.2 is affected by CVE-2026-58138, an unauthenticated RCE via malicious workflow definitions using

   via Mastodon https://cyberworldops.eu/en/exposed-orkes-conductor-apis-turn-workflow-scripts-into-root-level

3. update from dev.to

   Orkes Conductor CVE-2026-58138: Exploitation Activity Observed Against Unauthenticated Workflow RCE # security # threatintel # software # co

   dev.to · 25d ago · September 19th, 2026

   Orkes Conductor CVE-2026-58138: Exploitation Activity Observed Against Unauthenticated Workflow RCE # security # threatintel # software # co

   via Mastodon https://dev.to/anoymask/orkes-conductor-cve-2026-58138-exploitation-activity-observed-against-unauthenticated-workflow-rce-2gkk

4. update from thehackernews.com

   🤖 CVE-2026-58138 (CVSS 9.8): unauthenticated RCE in Orkes Conductor workflow platform, actively exploited in the wild per Fortinet. Affects

   thehackernews.com · 24d ago · September 19th, 2026

   🤖 CVE-2026-58138 (CVSS 9.8): unauthenticated RCE in Orkes Conductor workflow platform, actively exploited in the wild per Fortinet. Affects

   via Mastodon https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html

5. mentioned by thehackernews.com

   🤖 CVE-2026-58138 (CVSS 9.8): unauthenticated RCE in Orkes Conductor workflow platform, actively exploited in the wild per Fortinet. Versions

   thehackernews.com · 24d ago · September 19th, 2026

6. update from threatnoir.com

   ⚠️ CRITICAL: Critical Orkes Conductor Vulnerability Exploited in Attacks Orkes Conductor versions below 3.30.2 have an unauthenticated remot

   threatnoir.com · 24d ago · September 20th, 2026

   ⚠️ CRITICAL: Critical Orkes Conductor Vulnerability Exploited in Attacks Orkes Conductor versions below 3.30.2 have an unauthenticated remot

   via Mastodon https://threatnoir.com/focus

7. mentioned by theperimetersite.com

   Orkes Conductor has a real mess on its hands right now, and CVE-2026-58138 is a pre-authentication remote code execution vulnerability (the

   theperimetersite.com · 23d ago · September 20th, 2026

8. mentioned by thehackernews.com

   🤖 CVE-2026-58138 (CVSS 9.8): unauthenticated pre-auth RCE in the Orkes Conductor workflow platform, actively exploited in the wild per Forti

   thehackernews.com · 23d ago · September 20th, 2026

9. update from beyondmachines.net

   Critical Pre-Auth RCE in Orkes Conductor Under Active Exploitation Orkes Conductor versions prior to 3.30.2 are vulnerable to a critical una

   beyondmachines.net · 23d ago · September 20th, 2026

   Critical Pre-Auth RCE in Orkes Conductor Under Active Exploitation Orkes Conductor versions prior to 3.30.2 are vulnerable to a critical una

   via Mastodon https://beyondmachines.net/event_details/critical-pre-auth-rce-in-orkes-conductor-under-active-exploitation-5-v-3-f-3/gD2P6Ple2L

10. update from cyber.netsecops.io

    📰 Critical Pre-Auth RCE in Orkes Conductor Actively Exploited Critical pre-authentication RCE vulnerability in Orkes Conductor is being acti

    cyber.netsecops.io · 22d ago · September 21st, 2026

    📰 Critical Pre-Auth RCE in Orkes Conductor Actively Exploited Critical pre-authentication RCE vulnerability in Orkes Conductor is being acti

    via Mastodon https://cyber.netsecops.io/articles/orkes-conductor-critical-pre-auth-rce-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

11. mentioned by cybersecurefox.com

    CVE-2026-58138: Unauthenticated RCE in Orkes Conductor 🔗 https:// cybersecurefox.com/en/cve-2026 -58138-orkes-conductor-unauthenticated-rce

    cybersecurefox.com · 22d ago · September 21st, 2026