September 20, 2026
- Orkes Conductor CVE-2026-58138 (CVSS 9.8) is under sustained exploitation: pre-auth RCE via inline workflow definitions abusing unsandboxed GraalVM evaluators configured with
HostAccess.ALL. Fortinet blocked 1,290 attempts in 24 hours as of 9 September — a 132% jump in daily volume — and nearly 7,000 between 2 and 9 September, mostly from Germany, Hong Kong, Indonesia, the UAE and India. Empirical Security observed in-the-wild exploitation as far back as 21 August. Upgrade to 3.30.2. The Hacker News · Vulnerabilities & Exploits
in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks