Wisevoter
World

Critical Orkes Conductor Vulnerability Has Been Exploited

A remote code execution flaw in Orkes Conductor has triggered a surge in global malicious activity.

Updated on Sept. 19, 2026 in Cybersecurity

Isometric editorial illustration of a heavy brass padlock secured to a mechanical gear, representing technical security and vulnerability patching.
Orkes Conductor users are advised to upgrade to version 3.30.2 after attackers began exploiting a remote code execution vulnerability to compromise systems. AI Illustration. Upload story photo >

Live Poll

Do you regularly update your software to protect against newly discovered security vulnerabilities?

Attackers have exploited a critical remote code execution vulnerability, tracked as CVE-2026-58138, affecting various versions of Orkes Conductor. Security firms have observed a significant rise in unauthorized attempts to execute arbitrary OS commands via the workflow API.

Why it matters

The flaw allows attackers to bypass security measures by injecting malicious expressions into workflow definitions, potentially granting them full control over host systems. Organizations are urged to upgrade to version 3.30.2 or later to address the vulnerability.

The vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, affecting Orkes Conductor versions from 3.21.21 to 3.30.2. Exploitation occurs through unsandboxed GraalVM evaluators, which permit subprocess execution.

The players

Orkes Conductor

This is a cloud-native orchestration platform used for managing microservices and workflow automation.

Fortinet

This is a global cybersecurity company that provides network security appliances and intelligence services.

Previdian

This is a cybersecurity research firm that specializes in threat detection and honeypot monitoring.

Empirical Security

This is a security firm that monitors and analyzes active cyber threats and real-world exploitation.

The details

Attackers target the workflow API by submitting definitions containing malicious Python or JavaScript expressions. By leveraging Java reflection or direct subprocess calls within the workflow evaluators, they are able to execute unauthorized OS commands.

Timeline

  1. July 24, 2026: Previdian detected the earliest exploitation attempts on honeypots.

  2. August 21, 2026: Empirical Security identified in-the-wild exploitation of the flaw.

  3. September 2, 2026: The start of a period in which nearly 7,000 attacks were blocked.

  4. September 9, 2026: The end of the week-long period and a day saw 1,290 blocked attempts.

The Tech Race

The vulnerability highlights the security risks inherent in the use of high-performance polyglot runtimes like the GraalVM high-performance runtime environment when evaluators are not properly sandboxed. This incident underscores the ongoing challenge of securing complex, extensible workflow platforms against injection-based attacks.

Organizations utilizing affected versions of the software must immediately apply the patch to version 3.30.2 to prevent potential unauthorized access. IT administrators should prioritize auditing workflow API logs to identify any evidence of past malicious injections.

The takeaway

Maintaining strict sandboxing for any component that executes user-supplied code is essential to preventing modern remote code execution attacks. Always prioritize the installation of security updates for orchestration tools to mitigate risks to your broader infrastructure.

Further reading

Learn more about the latest industry trends and defensive strategies in the Cybersecurity section.

Live Poll

Do you regularly update your software to protect against newly discovered security vulnerabilities?