Posted on

Orkes Conductor CVE-2026-58138 – Active Pre-Authentication RCE

Threat Overview

Fortinet and independent reporting confirm active exploitation of CVE-2026-58138, a critical unauthenticated RCE in Orkes Conductor. Attackers can submit workflow definitions containing malicious JavaScript or Python expressions to vulnerable workflow API endpoints. Unsandboxed GraalVM evaluation with host access can lead to operating-system command execution. Fortinet observed 1,290 attempts in 24 hours and nearly 7,000 attempts during September 2-9. Public exploit code is available.

References

Impacted Systems

Orkes/conductor-oss Conductor 3.21.21 through versions before 3.30.2. Self-managed workflow orchestration servers are the primary concern. Internet-reachable workflow APIs increase risk. Fixed in 3.30.2.

Why this matters

Active exploitation plus pre-authentication OS command execution on an orchestration platform creates a direct route to application secrets, internal APIs, and downstream systems.

Exploitation Status

Confirmed active exploitation. Fortinet observed high-volume attempts. No specific actor attribution is established.

What this hunt looks for

Malicious workflow/API requests followed by Java child-process execution, temporary-file creation, persistence, and unusual Java network connections.

Required logs

Web/WAF or reverse-proxy logs in CommonSecurityLog, Defender XDR DeviceProcessEvents, DeviceNetworkEvents and DeviceFileEvents, and Linux Syslog where available.

First Pass – Conductor API Workflow Activity

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/api/workflow","/api/metadata/workflow","/workflow")
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Inline Script Indicators

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("/api/workflow","/api/metadata/workflow")
| where Message has_any ("INLINE","LAMBDA","DO_WHILE","SWITCH","javascript","python","Runtime.getRuntime","ProcessBuilder")
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Java Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where FileName in~ ("sh","bash","dash","cmd.exe","powershell.exe","pwsh.exe","curl","wget","python","python3")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

Rare Java Network Destinations

let Baseline=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(2d))
| where InitiatingProcessFileName in~ ("java","java.exe")
| summarize by DeviceId,RemoteIP,RemotePort;
DeviceNetworkEvents
| where Timestamp >= ago(2d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| join kind=leftanti Baseline on DeviceId,RemoteIP,RemotePort
| project Timestamp,DeviceName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Java File Creation in Temporary Paths

DeviceFileEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where ActionType in~ ("FileCreated","FileModified")
| where FolderPath has_any ("/tmp/","/var/tmp/","/dev/shm/","\\Temp\\")
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessCommandLine
| order by Timestamp desc

Persistence Following Java Execution

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("crontab","systemctl","schtasks.exe","reg.exe")
| where InitiatingProcessFileName in~ ("java","java.exe","sh","bash","cmd.exe","powershell.exe")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Syslog Post-Exploitation Fallback

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("java","conductor")
| where SyslogMessage has_any ("bash","sh -c","curl ","wget ","python ","sudo","cron","systemctl")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Detection Notes

Web request fields vary by parser. Java child-process behavior is high-value but not unique to Conductor. Lack of WAF/API logging can hide the initial exploit. Public reporting does not provide a stable malicious IP list suitable for primary detection.

Leave a comment