A critical vulnerability impacting **Orkes Conductor** is currently under active exploitation, according to a recent alert from **Fortinet**. ### The Vulnerability: CVE-2026-58138 Identified as **CVE-2026-58138**, this flaw carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, classifying it as a severe unauthenticated remote code execution (RCE) vulnerability. According to the **NIST National Vulnerability Database (NVD)**, the vulnerability affects **Orkes Conductor** versions 3.21.21 before 3.30.2. It allows remote attackers to execute arbitrary operating system commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed **GraalVM** evaluators configured with `HostAccess.ALL` or `allowAllAccess(true)` through `INLINE`, `LAMBDA`, `DO_WHILE`, and `SWITCH` task types. This enables them to invoke arbitrary system commands via Java reflection or direct subprocess calls. ### Active Exploitation Observed **Fortinet** issued an outbreak alert this week, confirming active targeting of **Orkes Conductor** servers susceptible to **CVE-2026-58138**. Attackers are submitting crafted workflow definitions containing JavaScript or Python expressions to the Conductor workflow API. "Because vulnerable evaluators can be configured with unrestricted host access, the attacker can escape the intended scripting environment and execute arbitrary operating system commands with the privileges of the Conductor process," **Fortinet** stated. As of September 9, 2026, **Fortinet** reported blocking 1,290 attack attempts within 24 hours, marking a 132% increase in daily activity. Nearly 7,000 attempts were blocked between September 2 and 9, 2026. The majority of these attacks originated from Germany, Hong Kong, Indonesia, the U.A.E., and India. Further telemetry data from **Previdian** indicates three exploitation attempts against its honeypots since July 24, 2026, originating from IP addresses in France and the U.S. Similarly, **Empirical Security** detected in-the-wild exploitation as recently as August 21, 2026. ### Mitigation Recommendations Organizations utilizing affected versions of **Orkes Conductor** are strongly advised to upgrade to version 3.30.2 or later, which includes the necessary patch. For those unable to patch immediately, several interim mitigation steps are recommended: * **Restrict External Access:** Limit external access to **Conductor** workflow API endpoints. * **Network Access Controls:** Place **Conductor** instances behind appropriate network access controls. * **Monitor Activity:** Implement robust monitoring for suspicious workflow submissions and unexpected command execution within the **Conductor** environment.