A Workflow Engine Flaw Is Under Active Attack

FortiGuard Labs issued an outbreak alert on September 15 for CVE-2026-58138, a critical, unauthenticated remote code execution flaw in Orkes Conductor, a workflow orchestration platform used to coordinate microservices, versions 3.21.21 through 3.30.1. The advisory states plainly that “FortiGuard telemetry is observing active attack attempts targeting vulnerable Orkes Conductor deployments.” The flaw sits in Conductor’s scripting evaluators: an attacker can submit a malicious workflow definition containing JavaScript or Python expressions directly to the Conductor API, before authenticating, and because some deployments configure those evaluators with unrestricted host access, the attacker can break out of the intended scripting sandbox and execute arbitrary operating system commands with the privileges of the Conductor process itself. The project has patched the flaw in Conductor 3.30.2.

Why it matters: Conductor sits in the orchestration layer, the component that already holds credentials and triggers actions across the services it coordinates, so a pre-authentication RCE there does not just compromise one system, it compromises whatever that system was trusted to call. Unauthenticated and remotely exploitable, per FortiGuard’s own assessment, puts any internet-exposed instance in the highest-priority remediation category regardless of what else is patched this week.

The original insight is in the gap between what “critical” software gets scrutinized and what does not. Conductor is workflow plumbing, not a perimeter product, the kind of internal orchestration layer that rarely gets the same external attack-surface review as a VPN gateway or an identity provider, yet it sits close enough to source-of-truth systems that a break-in there can move laterally fast. CyberTech has covered a similar pattern in an unauthenticated root RCE in Cisco’s Identity Services Engine and in CISA’s patch-deadline gap for actively exploited software, both cases where infrastructure components outran the attention paid to them.

Source: FortiGuard Labs