CVE-2025-26074

Critical9.8Published on June 30, 2025

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-78

Exposed Orkes Conductor APIs Turn Workflow Scripts Into Root-Level Attack Paths

Unauthenticated CVE-2026-58138 in Orkes Conductor allows RCE via malicious workflows. Learn affected versions, active exploitation, and how to patch.

This product uses the NVD API but is not endorsed or certified by the NVD.