Technology newsroom
Urgent Alert! Critical RCE Vulnerability in Orkes Conductor Under Attack, Admins Must Update Immediately 🚨
Fortinet issues an urgent alert regarding a Critical RCE vulnerability (CVSS 9.8) in Orkes Conductor, identified as CVE-2026-58138, which is actively being exploited by attackers. System administrators should patch immediately.
📌 Key Highlights:
- A critical Remote Code Execution (RCE) vulnerability (CVSS 9.8) has been discovered in the Orkes Conductor platform.
- Fortinet confirms that attackers are actively exploiting this vulnerability against unpatched systems (Exploited in the wild).
- This CVE-2026-58138 vulnerability requires no authentication (Pre-Auth), allowing attackers to gain remote control of systems.
Fortinet has issued an alert regarding the discovery of a critical security vulnerability in Orkes Conductor, a workflow orchestration platform used by many organizations. The vulnerability is identified as CVE-2026-58138 and has a severity score of 9.8 according to CVSS v3.1 standard, classifying it as extremely critical.
🚨 Vulnerability Details
This vulnerability is an Unauthenticated Remote Code Execution (RCE) type, meaning attackers do not need any username or password to send malicious commands to the server running Orkes Conductor and gain full remote control of the system. This poses an extremely severe threat to an organization's infrastructure.
🛠️ Affected Versions and Remediation
Reports indicate that Orkes Conductor versions from 3.21.21 up to, but not including, 3.30.2 are all affected by this vulnerability. Most concerning is Fortinet's confirmation of active exploitation of this vulnerability "in the wild," meaning the risk is no longer theoretical.
Therefore, system administrators using Orkes Conductor are urged to check their versions and update to the latest version (3.30.2 or higher) as soon as possible to close attack vectors and prevent potential damage to organizational data and systems. Complacency could lead to breaches and incalculable damage.
💬 Is anyone here using Orkes Conductor? Have you checked and updated your systems yet?