Critical Pre-Auth RCE CVE-2026-58138 in Orkes Conductor Under Active Attack

Threat actors are actively attempting to compromise workflow orchestration infrastructure by exploiting a critical unauthenticated remote code execution flaw tracked as CVE-2026-58138. The Orkes Conductor vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands on target servers by submitting crafted workflow definitions directly to exposed API endpoints.

The vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3. Its CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case profile for enterprise software: it is reachable over the network, requires low attack complexity, demands zero privileges, and requires no user interaction to achieve full system compromise. FIRST’s EPSS model measures the 30-day probability of exploitation at 9.3%—placing it in the 95.1th percentile of all tracked vulnerabilities and underscoring the immediate risk to exposed systems.

Technical Mechanics: GraalVM Sandbox Escape

Categorized under CWE-94 (Improper Control of Generation of Code), the flaw stems from how Orkes Conductor processes dynamic logic during workflow executions. In affected versions—specifically Orkes Conductor 3.21.21 up to but excluding 3.30.2—the platform evaluates custom expressions using embedded GraalVM script evaluators.

These evaluators were configured insecurely with broad host permissions, utilizing settings such as HostAccess.ALL or allowAllAccess(true). When handling workflow definitions containing INLINE, LAMBDA, DO_WHILE, or SWITCH task types, the workflow API evaluates incoming JavaScript or Python expressions prior to authenticating the request.

Because the evaluator lacks sandbox boundaries, an attacker can embed malicious expressions within the workflow payload. By leveraging standard Java reflection or calling system process interfaces directly from within the inline script, the payload escapes the interpreted runtime and executes arbitrary operating system commands with the full privileges of the host Conductor process.

Active Exploitation and Telemetry

Widespread automated scanning and exploitation are currently underway. Telemetry published by Fortinet highlights a sharp spike in attack volume targeting exposed Conductor workflow API endpoints. On September 9, 2026, defenders recorded 1,290 distinct exploit attempts within a 24-hour window—a 132% increase in daily attack activity. Between September 2 and September 9, nearly 7,000 exploitation attempts were blocked across global monitoring points.

The primary sources of this malicious activity originate from infrastructure located in Germany, Hong Kong, Indonesia, the United Arab Emirates, and India.

Exploitation is not limited to recent days. Telemetry from Previdian observed threat actors targeting honeypots as early as July 24, 2026, utilizing source IPs based in France and the United States. Empirical Security similarly confirmed in-the-wild exploitation attempts throughout August 2026.

Blast Radius and Operational Impact

Workflow orchestration platforms like Orkes Conductor occupy a central role in modern application stack architecture. They manage background microservices, control automated data pipelines, and interact with external business APIs. To execute these workflows, Conductor instances typically store or process high-privilege cloud environment credentials, database connection strings, and service account keys.

Gaining unauthenticated remote code execution on a Conductor instance grants an attacker an immediate foothold inside internal enterprise networks. Threat actors exploiting CVE-2026-58138 can:

• Access sensitive configuration files, environment variables, and memory-resident secrets to extract API keys and database credentials.
• Pivot laterally across microservices and cloud infrastructure using the trust relationships granted to the Conductor host.
• Alter active business workflows to manipulate operational logic or silently exfiltrate sensitive data streams.
• Deploy persistent backdoors or secondary payloads directly onto underlying application servers.

Patching and Defense Strategy

Organizations running affected installations must take immediate steps to secure their deployments.

Apply Vendor Updates

Upgrade all Orkes Conductor instances to version 3.30.2 or later. The release remediates the vulnerability by stripping permissive host access configurations (HostAccess.ALL / allowAllAccess(true)) from GraalVM evaluators, enforcing proper isolation on all inline workflow script executions.

Implement Immediate Isolation

If immediate patching cannot be completed, isolate the application at the network layer:

1. Block Exposed APIs: Ensure workflow API endpoints are not directly exposed to the public internet. Limit access strictly to authorized internal subnets or require access via VPN or Zero Trust Network Access (ZTNA) controls.
2. Web Application Firewall (WAF) Rules: Deploy inspection rules on perimeter firewalls and WAFs to monitor incoming POST requests to Conductor workflow APIs. Filter payloads containing Java reflection routines (such as java.lang.Runtime or ProcessBuilder) inside inline JavaScript or Python expressions.

Detection and Incident Response

Security teams should audit API access logs dating back to late July 2026 for suspicious, unauthenticated HTTP requests targeting workflow definition endpoints. Monitor underlying application host process trees for unexpected subprocesses or command shell invocations spawned by the main Conductor process.