A critical vulnerability in Orkes Conductor, tracked as CVE-2026-58138, is being actively exploited in attacks, according to SecurityWeek. The flaw is an unauthenticated remote code execution issue that can be triggered through inline workflow definitions, meaning an attacker does not need valid credentials to attempt exploitation.
Because the vulnerability requires no authentication, any attacker able to reach an affected instance could potentially compromise it. The report does not specify the scale of exploitation, but the fact that it is already being used in the wild raises the urgency for organizations running the software to review their exposure.
SecurityWeek's coverage is the sole source of this information, so no independent confirmation or additional technical details are available. Administrators should monitor vendor advisories and assess whether their deployments are reachable by untrusted parties.