Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical remote code execution vulnerability, identified as CVE-2026-58138, is currently being exploited by threat actors. According to Fortinet, this vulnerability exists within Orkes Conductor, a workflow orchestration platform. The flaw allows unauthenticated remote code execution, enabling attackers to execute arbitrary operating system commands by submitting malicious JavaScript or Python expressions to the Conductor workflow API endpoint. Specifically, attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls. As of September 9, 2026, Fortinet reported blocking 1,290 attack attempts within 24 hours, a 132% increase from the previous day. Attack activity originated primarily from Germany, Hong Kong, Indonesia, the U.A.E., and India. Telemetry data from Previdian indicated three exploitation attempts against honeypots since July 24, 2026, originating from France and the U.S. Empirical Security also detected in-the-wild exploitation as recently as August 21, 2026. Organizations using Orkes Conductor versions prior to 3.30.2 are strongly advised to upgrade to 3.30.2 or later. If immediate patching is not feasible, it is recommended to restrict external access to Conductor workflow API endpoints and implement network access controls.