Orkes Conductor Vulnerability Exposed to Active Exploitation
Security researchers have observed widespread exploitation of a remote code execution flaw in Orkes Conductor workflow APIs.
Updated on Sept. 19, 2026 in Cybersecurity
Live Poll
Do you regularly update your software to protect against newly discovered security vulnerabilities?
Attackers have begun actively exploiting a critical remote code execution vulnerability, tracked as CVE-2026-58138, within Orkes Conductor versions 3.21.21 through 3.30.1. The flaw allows unauthorized users to execute arbitrary operating system commands on affected servers.
Why it matters
This vulnerability threatens the integrity of workflow orchestration environments by granting attackers full system access. The surge in exploitation attempts highlights an urgent need for administrators to patch instances to version 3.30.2 or later to prevent compromise.
The vulnerability carries a critical CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3. Security vendors reported blocking nearly 7,000 attack attempts over one week, including 1,290 attempts within a single 24-hour period on September 9, 2026.
The players
Orkes Conductor
An open-source workflow orchestration engine used for building complex, distributed microservices applications.
Fortinet
A multinational corporation providing cybersecurity solutions, including firewalls and threat intelligence services.
Previdian
A security firm specializing in early-stage threat detection and honeypot-based monitoring.
Empirical Security
A cybersecurity research group focused on identifying and analyzing active, in-the-wild digital exploitation.
The details
The vulnerability stems from the use of unsandboxed GraalVM evaluators within the Orkes Conductor workflow API. Attackers submit malicious workflow definitions containing embedded Python or JavaScript expressions, which the system then executes. Because these evaluators are configured with unrestricted host access, they can invoke system commands through Java reflection or direct subprocess calls.
Timeline
July 24, 2026: Earliest exploitation attempt detected on Previdian honeypots.
August 21, 2026: Empirical Security detected in-the-wild exploitation.
September 2, 2026: Start of period for 7,000 recorded attack attempts.
September 9, 2026: End of period for recorded attack attempts, with 1,290 blocked in 24 hours.
The Tech Race
The rapid weaponization of this workflow API flaw follows a pattern set by the Log4Shell vulnerability exploitation, where common enterprise dependencies were quickly targeted by attackers. This event signals a shift toward automating attacks against orchestration engines that manage critical infrastructure.
Organizations running Orkes Conductor versions 3.21.21 through 3.30.1 are currently at high risk and must prioritize upgrading to version 3.30.2. Failure to apply this patch leaves internal API endpoints susceptible to full system command execution by remote actors.
The takeaway
The sustained volume of attacks suggests this vulnerability is a primary target for automated scanning tools. Security teams should audit logs for suspicious workflow API calls and confirm that all instances are updated to version 3.30.2 immediately.
Further reading
For more information on securing enterprise workflow infrastructure, visit Cybersecurity.
Live Poll
Do you regularly update your software to protect against newly discovered security vulnerabilities?
