Loading story…
Attackers are actively exploiting CVE-2026-58138, a critical unauthenticated remote-code-execution flaw in Orkes Conductor. Unsafe evaluation of attacker-controlled JavaScript or Python expressions in inline workflow definitions lets attackers escape GraalVM scripting restrictions and execute operating-system commands as the Conductor process—potentially with root privileges. Public exploit code, including an exploit targeting Conductor v3.23.0 published as Exploit-DB EDB-52633, preceded observed attacks; Fortinet recorded roughly 1,300 blocked exploitation attempts over September 8–9.
Orkes addressed the issue in Conductor v3.30.2 in June 2026, and organizations should urgently upgrade exposed deployments, restrict access to workflow APIs, and place instances behind firewalls. Defenders should examine systems that ran vulnerable versions for malicious workflow definitions and evidence of command execution. The issue follows an earlier related Conductor flaw, CVE-2025-26074, which enabled OS command execution through unrestricted Java-class access in v3.21.11.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
FortiGuard released a Threat Signal Report concerning active attempts to exploit CVE-2026-58138 in vulnerable Orkes Conductor deployments.
Fortinet blocked approximately 1,300 attempts to exploit CVE-2026-58138 over September 8-9, indicating ongoing opportunistic attacks against vulnerable Orkes Conductor deployments.
Empirical Security identified attacks exploiting CVE-2026-58138 in the wild after public proof-of-concept code became available.
Exploit-DB published EDB-52633, a public unauthenticated RCE exploit for CVE-2026-58138, including a working exploit targeting Conductor v3.23.0.
Orkes patched the critical unauthenticated remote-code-execution flaw CVE-2026-58138 in Conductor version 3.30.2.
MITRE published CVE-2025-26074, documenting that Orkes Conductor v3.21.11 could allow remote attackers to execute arbitrary operating-system commands through unrestricted access to Java classes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcefortiguard.fortinet.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited **Oracle WebLogic Server** flaw `CVE-2020-14882` to achieve unauthenticated remote code execution, with intrusions quickly progressing from opportunistic scanning to malware deployment. Incident reporting showed one campaign using obfuscated PowerShell to fetch a **Cobalt Strike** payload from `185[.]205.210.179`, while another used a malicious `wbw.xml` file and follow-on scripts to install **XMRig**, rename it to `sysupdate`, and establish persistence with a scheduled task, driving victim CPU usage to 100%. Researchers warned the same access pattern could be readily adopted by ransomware operators because Cobalt Strike is commonly used in hands-on-keyboard attacks. Technical analysis tied the exploitation to improper access control and path traversal in WebLogic console resources, where double URL decoding and abuse of `console.portal` and the `handle` parameter enabled code execution through **MVEL** and reflection. Oracle’s initial fix was found to be incomplete because blacklist-based URL filtering could be bypassed with trivial changes, leading to the related patch-bypass issue `CVE-2020-14750`. Defenders were urged to apply Oracle’s latest patches and hunt for indicators linked to `console.portal`, malicious PowerShell downloaders, miner artifacts, and published **YARA**, **Sigma**, and **Suricata** detections.
Aug 15, 2026
Attackers rapidly began exploiting **CVE-2023-22527**, a critical `CVSS 10.0` remote code execution flaw in **Atlassian Confluence Data Center and Confluence Server**, within days of public disclosure. The vulnerability affects outdated Confluence 8 releases issued before December 5, 2023, as well as version `8.4.5`, and stems from **OGNL expression injection** that can let unauthenticated attackers execute arbitrary code on exposed servers. Telemetry from Shadowserver Foundation and The DFIR Report recorded nearly **40,000 exploitation attempts** over three days from more than **600 unique IP addresses**, indicating broad opportunistic scanning across the internet. Observed activity included callback testing and basic reconnaissance such as running `whoami`, suggesting attackers were validating access for potential follow-on compromise; at the time, more than **11,000 Atlassian instances** were internet-accessible, underscoring the exposure risk for unpatched organizations.
Aug 15, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026