Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Critical pre-auth RCE in Orkes Conductor exploited in the wild.
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor is being actively exploited. Attackers can submit malicious workflow definitions to execute arbitrary OS commands by exploiting unsandboxed GraalVM evaluators. Fortinet observed a significant increase in attack attempts, with the majority originating from Germany, Hong Kong, Indonesia, the U.A.E., and India.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-58138 exposes a critical unauthenticated remote code execution flaw in Orkes Conductor stemming from an unsandboxed GraalVM evaluator that processes user-supplied workflow definitions without proper isolation or authentication gates. Because no credentials are required to trigger the exploit, any internet-facing Conductor instance is immediately at risk, dramatically lowering the bar for attackers. Active exploitation observed across multiple countries underscores how quickly threat actors weaponize workflow and orchestration platforms, which are often overlooked in patch cycles despite their privileged access to backend systems. Organizations running automation or workflow platforms must treat them with the same urgency as perimeter-facing assets.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-58138