Conductor's 9.8 is unauthenticated GraalVM RCE. 3.30.2 shipped in June. CISA still has no KEV row.

CVE-2026-58138 is pre-auth OS command execution through INLINE tasks. Fortinet blocked 1,290 attempts in a day. The June notes never said CVE. 3.30.1 is still in the affected range.

RWP Ventures · 2026-09-20 · event 2026-09-19 · 13 min read · priority 8.3

The bug is not a mystery parser. INLINE, LAMBDA, DO_WHILE, and SWITCH tasks evaluate attacker-supplied JavaScript or Python on a GraalVM context built with HostAccess.ALL / allowAllAccess(true). That is full host access. The community API does not require authentication by default. A reachable workflow API is the incident class.

Exploitation is CONFIRMED by more than one sensor owner. It is not in CISA KEV. Catalog 2026.09.18 (released 18 September 19:00 UTC, count 1716), checked this morning, has no row for 58138. Do not wait for one.

Fortinet’s outbreak alert (15 September) and threat-signal report (9 September) are the volume numbers in English coverage this week: 1,290 IPS blocks in 24 hours as of 9 September (+132% day-over-day); 6,696 over seven days (+17% week-over-week). Origins of that blocked traffic, not attribution: Germany, Hong Kong, Indonesia, the U.A.E., India. The Hacker News carried the combined write-up on 19 September. SecurityWeek, 18 September.

This is not a re-run of [yesterday’s Linux kernel KEV trio](/posts/2026-09-19-linux-kernel-kev-ktls-ebtables-afalg/). Different product, different clock, and CISA has not listed it.

What happened

Conductor is a Java workflow engine. Platform, data, and ML teams use it to orchestrate microservices, jobs, and — increasingly — agent pipelines. The OSS build is what most security inventories never name.

Two GitHub commits are the patch trail:

• 87a7d96 (5 May 2026, PR #1057): “Deny access to some classes in js evaluator, deny host access in python evaluator.” Files: ScriptEvaluator.java, PythonEvaluator.java.
• c691e35 (22 May 2026, PR #1123, merged by c4lm): “Restrict graaljs further.” Release v3.30.2 (published 3 June 2026, 03:24 UTC) lists that PR as a bugfix. The notes do not say CVE, RCE, or security advisory.

CVE-2026-58138 landed 27 days later, 30 June, assigned by VulnCheck. NVD last-modified 14 July. CISA-ADP’s earlier SSVC snapshot said exploitation none; that snapshot is stale against September telemetry. Treat Fortinet / Empirical / Previdian as the current exploitation record, not the July SSVC row.

Public exploit material followed. Exploit-DB EDB-52633 is dated 10 August 2026 (Fortinet’s outbreak timeline says 9 August). RWP is not reproducing it. Existence of a public PoC is CONFIRMED. The payload is not needed to hunt.

Sensor timeline, as published — not a single campaign:

No vendor PSIRT blog from Orkes was in the primary set this morning. The remediation record is the GitHub tag and the CNA range.

Why it matters

Three facts should not be collapsed.

First: the patch did not announce itself as a patch. A June point release that says “restrict graaljs further” will not fire a CVE-driven scanner, a KEV SLA, or a change-advisory board that only reads CISA. That is why Empirical titled it the 9.8 nobody knows they are running. The failure mode is not “we ignored a KEV due date.” There is no due date.

Second: the install is a workflow brain, not a brochure app. A Conductor process that can start INLINE tasks can reach whatever that host’s identity already can — cloud keys, queue credentials, internal HTTP, the next microservice. Compromising the orchestrator is not the same as defacing a marketing CMS. Do not write “website RCE” on the ticket.

Third: default-open API plus HostAccess.ALL is the whole bug. Teams that put SSO in front of the UI and left :8080/api on a cluster network have not authenticated the thing that evaluates the script. Internet exposure is the worst case. An unauthenticated API on a shared Kubernetes network is still a pre-auth RCE against whatever else that namespace holds.

We have no confirmed OT, ICS, or physical-process impact. A Conductor instance used to schedule plant-adjacent jobs is still an IT compromise unless someone produces process evidence. Do not write one.

Empirical quotes Orkes marketing: Conductor “runs inside more than 3,000 enterprises,” with LinkedIn, Twilio, and Quest Diagnostics named as vendor examples. Those names are REPORTED as Orkes’s figures via Empirical, not an RWP victim list and not a confirmed exposure census.

Who / what is affected

Technical context

RWP is not publishing INLINE JavaScript, GraalVM interop, or a register-and-start sequence.

What defenders need from the primary records:

• Evaluator, not “a REST bug.” CVE text: unsandboxed GraalVM evaluators on INLINE, LAMBDA, DO_WHILE, and SWITCH. HostAccess.ALL turns the sandbox off. Java reflection or subprocess from that context is OS command execution as the Conductor UID.
• API, not login. Empirical (quoted by SecurityWeek): the OSS server enforces no authentication by default and leaves the workflow API open. Hunt unauthenticated POSTs that register a workflow definition and start it. Product paths in public hunting notes: metadata workflow registration and /api/workflow/{name} starts. Those are documented APIs. Treat unexpected unauthenticated hits as suspicious. Do not use them as a test harness against systems you do not own.
• Two-step fix in git. #1057 denies some classes and Python host access. #1123 further restricts graaljs. The CNA still draws the line at 3.30.2. Operators who stopped at 3.30.0 or 3.30.1 are inside the affected range.
• Version check. SentinelOne’s public note points at Conductor’s admin config JSON for a version string. Confirm against the running image tag and the jar/build you actually boot, not the Helm chart’s appVersion you meant to ship.

ATT&CK mapping for what is stated, not a hypothetical chain:

• Initial access against a reachable API: exploit public-facing application (T1190).
• Script evaluation: command and scripting interpreter (T1059), JavaScript/Python inside GraalVM, not a user clicking a file.
• Follow-on shell as the Conductor process: ASSESSED if Runtime/ProcessBuilder is reached; not a named implant.

Follow-on that is not claimed: a named C2, a ransomware brand, identity of Fortinet’s source countries with a group, or container-escape beyond the Conductor PID.

Threat / exploitation status

High confidence on: CVE ID, CVSS, CNA version range, 3.30.2 as floor, commit SHAs and dates, absence from catalog 2026.09.18, Fortinet’s published block counts and dates, EDB ID. Moderate confidence that internet-exposed OSS images on 8080 are the highest-leverage exposure (product default + Fortinet “do not expose” guidance; no public census). Low confidence on victim set, what the blocked attempts actually achieved, and whether Fortinet’s source-country mix is one operator.

X posts this morning repeated the THN/Fortinet numbers. Treat X as discovery, not a second independent measurement.

What defenders should do

1. Inventory Conductor, not “Java apps.” Search for conductoross/conductor images, Helm releases, page title Conductor UI, Swagger at /swagger-ui, default 8080, and platform/ML workflow charts that wrap the same evaluator. Shadow IT is the point. Empirical’s Shodan/Censys hint is http.title:"Conductor UI" — use it as an internal and external exposure query, then confirm version.

1. If you are below 3.30.2, upgrade. 3.30.1 is not remediation. Pull a current image (3.32.4 or later in the 3.32 line as of 10 September) rather than stopping at the CVE floor if your change process allows it. Confirm the running tag after the rollout.

1. If you cannot upgrade today, take the API off untrusted networks. Fortinet’s until-patched list: restrict external access to workflow API endpoints; segment; do not expose the service to the internet; monitor suspicious workflow submissions and unexpected command execution from the Conductor process. Putting SSO on the UI only is not that list.

1. Hunt before you declare the host clean. Preserve API logs covering workflow metadata registration and workflow start from at least 24 July (first public honeypot date in this record) through today. Look for unauthenticated clients, INLINE/LAMBDA/DO_WHILE/SWITCH tasks you did not author, new workflow names, and child processes of the Conductor UID (shells, curl, miners, unexpected JDKs). There is no public IOC pack in Fortinet’s outbreak page that RWP independently extracted as a hash list. Do not invent one.

1. Assume secrets on that host are in play if you were exposed. Rotate cloud keys, queue credentials, and tokens the Conductor task workers could read. Patching the image does not invalidate a key that already left.

1. Do not wait for KEV. [Linux kTLS CVE-2025-39682](/posts/2026-09-19-linux-kernel-kev-ktls-ebtables-afalg/) is on a 21 September federal clock because CISA listed it. This CVE is exploited and unlisted. KEV is a prioritization input, not a permission slip. Sequence it against the rest of this week’s already-published control-plane work: [Cisco ISE CVE-2026-76460](/posts/2026-09-17-cisco-ise-cve-2026-76460-auth-bypass/) (KEV due 19 September), [Check Point CVE-2026-91843](/posts/2026-09-18-checkpoint-mgmt-cve-2026-91843-root-rce/) (still not in 2026.09.18), [vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/) (ransomware-Known).

This is not an exploitation guide. Use the GitHub tag and your API logs.

RWP assessment

Score 8.3. Unauthenticated RCE on a workflow orchestrator, public PoC since August, Fortinet outbreak numbers in the thousands, and a June fix that never said CVE. English coverage landed 19 September, after [yesterday’s kernel KEV Daily Top](/posts/2026-09-19-linux-kernel-kev-ktls-ebtables-afalg/). RWP considered this CVE as a runner-up on 18 and 19 September and has not published it as a Daily Top.

It outranks SolarWinds Access Rights Manager CVE-2026-28326 (THN 19 September; hardcoded static key; CVSS 8.8 AV:A; advisory 17 September; no in-wild claim from SolarWinds; adjacent-network, not the same exposure class). It outranks Microsoft CVE-2026-85889 Azure AI Foundry CVSS 10 (17 September MSRC; already mitigated in the service; no customer action; no exploitation). It outranks Gravity Forms CVE-2026-84434 (Wordfence 18 September; unauth upload, 9.8, hidden file-upload field prerequisite; no exploitation in the record we used). It outranks Unbound CVE-2026-81642 and the BIND 9.20.29 set (mid-September DNS security releases; CISA/NLnet Labs: no exploitation as of 17 September). Linux kernel KEV, ISE 76460, SEG 76461, vCenter 59310, and Check Point 91843 are continuations of this week’s already-published tops.

The failure mode to sand down is “it is not in KEV so it is not this week” and its twin, “we do not run Orkes.” Ask whether a Conductor image or a workflow UI titled Conductor is on a network you own. Then read the tag. Then read the API log.

What we are watching

• Whether CISA adds 58138 to KEV, and whether the ransomware field stays blank.
• An Orkes or conductor-oss security advisory that states cloud vs OSS scope in one sentence.
• Distro/Helm lag that ships 3.30.1 as “latest.”
• Any named victim, ransomware brand, or implant family tied to this CVE with evidence.
• SolarWinds ARM CVE-2026-28326 if exploitation appears.
• Any attempt to treat a Conductor compromise at an industrial tenant as an OT event without process evidence.

Sources

• The Hacker News — Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild (19 September 2026)
• FortiGuard Labs — Outbreak Alert: Orkes Conductor Evaluator Remote Code Execution (15 September 2026)
• FortiGuard Labs — Threat Signal: Orkes Conductor Evaluator Remote Code Execution (9 September 2026)
• SecurityWeek — Critical Orkes Conductor Vulnerability Exploited in Attacks (18 September 2026)
• CVE.org — CVE-2026-58138
• NVD — CVE-2026-58138
• VulnCheck — Orkes Conductor unauthenticated RCE via GraalVM script evaluators
• Empirical Security — September 2026 CVE of the Month (1 September 2026)
• GitHub — conductor-oss/conductor v3.30.2
• GitHub — Restrict graaljs further, c691e35
• GitHub — Deny access to some classes in js evaluator, 87a7d96
• CISA KEV JSON feed
• CISA Known Exploited Vulnerabilities Catalog
• Exploit-DB — EDB-52633
• [RWP Daily Top, 19 September 2026 — Linux kernel KEV](/posts/2026-09-19-linux-kernel-kev-ktls-ebtables-afalg/)
• [RWP Daily Top, 18 September 2026 — Check Point CVE-2026-91843](/posts/2026-09-18-checkpoint-mgmt-cve-2026-91843-root-rce/)
• [RWP Daily Top, 17 September 2026 — Cisco ISE CVE-2026-76460](/posts/2026-09-17-cisco-ise-cve-2026-76460-auth-bypass/)
• [RWP Daily Top, 16 September 2026 — vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/)