⚠️ Region Alert: UAE/Middle East
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2026-58138, is being actively exploited in the wild against Orkes Conductor servers. The flaw allows attackers to execute arbitrary operating system commands by submitting crafted inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API. This vulnerability stems from unsandboxed GraalVM evaluators configured with unrestricted host access, enabling attackers to bypass the scripting environment via Java reflection or direct subprocess calls.
Fortinet reports a massive surge in exploitation attempts, with over 7,000 blocks recorded in early September 2026. Significant attack activity has been traced to several regions, including the U.A.E., Indonesia, and Hong Kong. Security researchers from Previdian and Empirical Security have also verified ongoing exploitation. Organizations are advised to immediately upgrade to Conductor version 3.30.2 or later and restrict external access to workflow API endpoints.
Top comments (0)