Critical 9.8 CVSS Orkes Conductor Flaw Under Active Exploitation

A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor is currently under active exploitation. The flaw carries a 9.8 CVSS v3.1 score and allows attackers to execute arbitrary OS commands by submitting malicious workflow definitions prior to authentication. Fortinet telemetry recorded nearly 7,000 attack attempts between September 2 and September 9, 2026. The exploit relies on unsandboxed GraalVM evaluators configured with unrestricted host access that fail to isolate the intended scripting environments. Administrators are advised to upgrade to version 3.30.2 or restrict external access to Conductor workflow API endpoints if immediate patching isn't possible. "Because vulnerable evaluators can be configured with unrestricted host access, the attacker can escape the intended scripting environment and execute arbitrary operating system commands with the privileges of the Conductor process." — Fortinet