Orkes Conductor RCE Draws Nearly 7,000 Exploit Attempts

A critical remote code execution flaw in Orkes Conductor is under active attack, with Fortinet blocking 6,696 exploitation attempts in seven days.

CVE-2026-58138 affects Conductor versions 3.21.21 through 3.30.1 and carries a CVSS v3.1 score of 9.8. An unauthenticated attacker who can reach the workflow API can execute operating system commands without logging in.

According to Fortinet’s outbreak alert, 1,290 attempts were blocked in one 24-hour period, a 132% increase in daily activity. The figures represent attempted exploitation, not 6,696 confirmed compromises.

How CVE-2026-58138 works

The National Vulnerability Database says attackers can submit malicious JavaScript or Python expressions inside workflow definitions before authentication.

Vulnerable GraalVM evaluators can then allow those scripts to escape their intended restrictions and invoke operating system commands through INLINE, LAMBDA, DO_WHILE, and SWITCH task types.

Commands run with the privileges of the Conductor process. Some deployments may run that process as root inside a container, increasing the potential impact, although that does not by itself mean an attacker can escape to the underlying host.

The flaw is particularly concerning for workflow infrastructure because systems such as Conductor can connect applications, APIs, databases, and AI agents. A recent eSecurity Planet investigation found 36,769 self-hosted AI services exposed online, including thousands of workflow and agent-building endpoints.

Patch to Conductor 3.30.2 or later

Conductor 3.30.2, released June 3, contains the complete fix. Its release notes described the relevant change only as restricting GraalVM JavaScript further, and CVE-2026-58138 was not published until June 30.

Versions 3.30.0 and 3.30.1 remain vulnerable, so organizations should not stop at an earlier 3.30.x build.

Public exploit code is now available, reducing the work required to target exposed servers. Fortinet’s telemetry indicates broad exploitation activity rather than evidence of one identified intrusion campaign.

What defenders should do now

Organizations running affected Conductor versions should prioritize these steps:

• Upgrade to 3.30.2 or later.
• Remove workflow APIs from the public internet where external access is unnecessary.
• Restrict /api/metadata/workflow and /api/workflow behind authenticated network controls.
• Review workflow definitions for unfamiliar JavaScript, Python, INLINE, LAMBDA, DO_WHILE, or SWITCH tasks.
• Monitor the Conductor Java process for unexpected shells, command interpreters, curl, or other child processes.
• Check outbound traffic from Conductor hosts for unexplained destinations.
• Rotate exposed credentials and keys if a vulnerable internet-facing system may have been compromised.

A Sept. 21 warning from SK-CERT likewise recommends immediate patching, log review, and changing passwords or keys after potential exposure.

Patching should be followed by investigation on systems that were reachable while vulnerable. That same approach applies to other exploited infrastructure flaws, including the recent GitLab vulnerability exposing server files and credentials.

Fortinet’s latest figures establish active exploitation attempts, but they do not establish thousands of successful breaches. For exposed Conductor servers still running 3.21.21 through 3.30.1, the immediate priorities are patching, restricting API access, and checking for evidence that malicious workflows already ran.

Also read: Cisco FMC flaws are being exploited to steal credentials, tunnel into internal networks, and deploy ransomware.