FortiGuard Threat Signal / Outbreak Alert (released 9 September 2026) tracks active attack attempts against CVE-2026-58138 in Orkes Conductor / conductor-oss: unauthenticated remote code execution via GraalVM script evaluators.

According to the CVE record, attackers submit inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint before authentication, and evaluators configured with HostAccess.ALL or allowAllAccess(true) through the INLINE, LAMBDA, DO_WHILE and SWITCH task types then run arbitrary system commands; FortiGuard says the commands run with the privileges of the Conductor process. The CVE record gives the affected range as Conductor 3.21.21 before 3.30.2, and FortiGuard says 3.30.2 or later addresses the flaw.

Public proof-of-concept code exists, including a working exploit targeting Conductor 3.23.0, and exploit material has been published on Exploit-DB (FortiGuard). FortiGuard telemetry: 1,290 IPS blocks in 24 hours (up 132%) and 6,696 over seven days; top observed sources Germany, Hong Kong, Indonesia, the UAE and India. The CVE record rates it CVSS 3.1 9.8 and CVSS 4.0 9.3.

No Australian exploitation reported. (sources: FortiGuard threat signal; the CVE record)

Correction (26 Oct 2026): the affected range and CVSS scores are now credited to the CVE record, and a SecurityWeek source this Cyberstack does not use has been removed, along with details no linked source supports: that Conductor often runs as root, that open-source Conductor leaves the workflow API unauthenticated by default, that 3.30.0 and 3.30.1 carried an incomplete partial blocklist, and an Empirical Security report of exploitation from about 21 August. (source: FortiGuard; CVE record)