[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fclZB0-9a3WRHfeJRKVc2xc_JS4OESvvO0Pb2WH0Mpmc":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"7852204b-f88d-4d95-b1d5-a18e9d132a25","Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild","critical-pre-auth-rce-in-orkes-conductor-workflow-platform-exploited-in-the-wild-c8cb9c","A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8\u002FCVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. \"Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote","A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor is being actively exploited. Attackers can submit malicious workflow definitions to execute arbitrary OS commands by exploiting unsandboxed GraalVM evaluators. Fortinet observed a significant increase in attack attempts, with the majority originating from Germany, Hong Kong, Indonesia, the U.A.E., and India.","Critical pre-auth RCE in Orkes Conductor exploited in the wild.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcritical-pre-auth-rce-in-orkes.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjL-YeIVFaRBKvtwQKBxAilhKMaZP_x6L979d8JL60W3AEHy9o2sfL_dMrJWy_sPIV70oIbP6DYe2KVhHh-mwbB4zBvrV_jEgdRiuc_IzNyyPSfUAOGvAp7J7JO06OWUWjSwuqpU4JJ_kNy0vtW1D9_gEtQNNVmWiYzRTpYMwhe-J3Bvve3EHrAp81Wht4L\u002Fs1600\u002Forkes.jpg","2026-09-19T08:18:54+00:00","2026-09-19T10:00:18.068214+00:00",9,[17,20,23],{"name":18,"type":19},"Orkes Conductor","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"GraalVM","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-58138","Critical unauthenticated RCE vulnerability in Orkes Conductor",[21,18],{"controls":51,"vendors":138},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":111,"name":112,"problem":113,"products":114},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":132,"vendor_name":21,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",[139],{"slug":132,"name":21,"logo_path":133,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":157},"pre-auth-rce-in-orkes-conductor-exploited-in-the-wild","Pre-Auth RCE in Orkes Conductor Exploited in the Wild","CVE-2026-58138 exposes a critical unauthenticated remote code execution flaw in Orkes Conductor stemming from an unsandboxed GraalVM evaluator that processes user-supplied workflow definitions without proper isolation or authentication gates. Because no credentials are required to trigger the exploit, any internet-facing Conductor instance is immediately at risk, dramatically lowering the bar for attackers. Active exploitation observed across multiple countries underscores how quickly threat actors weaponize workflow and orchestration platforms, which are often overlooked in patch cycles despite their privileged access to backend systems. Organizations running automation or workflow platforms must treat them with the same urgency as perimeter-facing assets.",[147,148,149,150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST AC-3: Access Enforcement","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST SC-39: Process Isolation","OWASP A05:2021 – Security Misconfiguration","OWASP A01:2021 – Broken Access Control",{}]