Orkes Conductor CVE-2026-58138: Unauthenticated RCE Under Active Exploitation

En bref

• CVE-2026-58138 is a critical unauthenticated RCE in Orkes Conductor.
• Affected versions run from 3.21.21 up to before 3.30.2.
• Fortinet reports active exploitation in the wild.
• CVSS scores are 9.8 v3.1 and 9.3 v4.
• Patch to 3.30.2 or later and isolate unpatched instances.

Orkes Conductor, a platform used to orchestrate workflows and integrations, is affected by a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-58138. Fortinet reports that the flaw is being exploited in the wild. The vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3. According to the available information, Orkes Conductor versions from 3.21.21 up to but not including 3.30.2 are vulnerable.

Any organization running an affected Conductor instance should treat this as urgent, especially if the service is reachable from the internet. Because the flaw is pre-authentication, an attacker does not need valid credentials to attempt exploitation. In a school district or government environment, Conductor may be used for automation, data integration, or service orchestration, which can make it a valuable foothold for further access.

The impact of a successful exploit could be severe. Remote code execution can allow an attacker to run commands on the host, access configuration data, reach connected systems, or disrupt services. Workflow platforms often store or use API keys, database credentials, and integration secrets, so a compromise could expose more than the Conductor instance itself.

Active exploitation means waiting is risky. The vendor has a fixed version in 3.30.2, so upgrading is the primary remediation. If an immediate upgrade is not possible, reducing exposure is critical: remove public access, restrict connections to trusted networks, and monitor for signs of compromise. Security teams should also watch for updated guidance and indicators of compromise from Fortinet and the vendor, and review logs for unusual activity on Conductor hosts.

À faire maintenant

1. Inventory all Orkes Conductor instances and confirm their versions, prioritizing any that are internet-facing.
2. Upgrade affected instances to version 3.30.2 or later as soon as possible.
3. If patching is delayed, remove public exposure and restrict access through VPN, allowlists, or trusted network segments.
4. Review logs for exploitation signs, including unexpected processes, suspicious web requests, and unusual outbound connections.
5. Rotate credentials, API keys, and secrets stored in or accessible to Conductor.
6. Apply temporary WAF or network filtering rules if available, but do not rely on them as the sole fix.
7. Monitor vendor and Fortinet advisories for updated indicators of compromise and guidance.

Références CVE

• CVE-2026-58138

Source originale

The Hacker News