PT-2025-27453 · Orkes · Orkes Conductor

Mrcnry · CVE-2025-26074 · Published 2025-06-30 · Updated 2025-07-16

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Orkes Conductor version 3.21.11

Description: The issue allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. This can lead to remote code execution in Orkes Conductor.

Recommendations: Update to version 3.21.13 or later to mitigate risks and secure your systems.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-26074

GHSA-8GQP-HR9G-PG62

Affected Products

Orkes Conductor

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-26074 · Security Note
• https://osv.dev/vulnerability/GHSA-8gqp-hr9g-pg62 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26074 · Vendor Advisory
• https://github.com/conductor-oss/conductor · Note
• https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java · Note
• https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b · Note
• https://twitter.com/CVEnew/status/1939734443733696559 · Twitter Post
• https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb · Note
• https://twitter.com/vulert_official/status/1939931753746944360 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1939782175324275171 · Twitter Post
• https://t.me/cvenotify/127144 · Telegram Post
• https://t.me/cvetracker/27443 · Telegram Post
• https://twitter.com/CheckmarxZero/status/1945474306948935795 · Twitter Post