Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild Ravie LakshmananSep 19, 2026Vulnerability / Web Security A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication," a description of the flaw on the NIST National Vulnerability Database (NVD) reads. "Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL…