A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in the Orkes Conductor workflow platform is being actively exploited in the wild. The flaw affects versions before 3.30.2 and carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3. Fortinet researchers confirmed the exploitation, urging immediate patching to version 3.30.2 or later.

What should defenders do?

Update Orkes Conductor to version 3.30.2 or later immediately. Apply the security update provided by Orkes. Monitor for further advisories from Orkes and Fortinet. If immediate updating is not possible, consider network segmentation and access controls to limit exposure until patching can be completed.

criticalvulnerability

Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild

Fortinet researchers warn of actively exploited vulnerability allowing unauthenticated remote code execution

CyberIntel DeskPublished 10 days agoUpdated less than a minute ago1 min read

Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild

Key Takeaways

CVE-2026-58138 is a critical unauthenticated remote code execution vulnerability in Orkes Conductor.
The flaw affects versions before 3.30.2 and is being actively exploited in the wild.
CVSS scores: 9.8 (v3.1) and 9.3 (v4), indicating critical severity.
Fortinet researchers confirmed the exploitation; Orkes has released version 3.30.2 as a patch.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read