CVE intelligence

CVE-2026-58138

Vulnerability intelligence

Published Jun 30, 2026Sources checked Oct 3, 2026

9.8CRITICALCVSS out of 10

What this means

Exploitation reported: act now

The Hacker News reports exploitation in the wild. This is separate from CISA KEV membership.

Public exploit: Cataloged public exploit. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

The Hacker News: Exploitation reported by The Hacker News (2026-09-19)
Exploit-DB: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution (2026-09-23 21:40:27.335989+00)

CISA KEVNot listedBased on the latest collected catalog

EPSS14.7%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-58138?

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.