{"id":"CVE-2025-26074","aliases":["EUVD-2025-19560","GHSA-8gqp-hr9g-pg62"],"status":"published","title":"Conductor vulnerable to OS command injection through unrestricted access to Java classes","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00713,"percentile":0.53962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2025-06-30T00:00:00Z","modified":"2026-09-10T03:50:25Z","fixes":[{"ecosystem":"Maven","package":"org.conductoross:conductor-core","fixed_in":["3.21.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.conductoross:conductor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.13"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.conductoross:conductor-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.13"}]}],"versions":[".30.0.rc1",".30.0.rc18",".30.0.rc5","3.16.0","3.17.0","3.18.0","3.19.0","3.20.0","3.21.0","3.21.1","3.21.10","3.21.11","3.21.12","3.21.2","3.21.3","3.21.4","3.21.5","3.21.6","3.21.7","3.21.8","3.21.9","3.3.0.rc2","3.3.0.rc3","3.3.0.rc4","3.3.0.rc5","3.3.0.rc6","3.3.0.rc7","3.3.0.rc8","3.4.0"]}],"references":[{"url":"https://github.com/conductor-oss/conductor","tags":["package"]},{"url":"https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java","tags":["web"]},{"url":"https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26074","tags":["advisory"]},{"url":"https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8gqp-hr9g-pg62"}],"sources":{"cve":[{"id":"CVE-2025-26074","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","status":"published","published":"2025-06-30T00:00:00Z","modified":"2025-06-30T18:44:46.795Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-19560","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","status":"published","published":"2025-06-30T00:00:00Z","modified":"2025-06-30T18:44:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:15.30157Z"}],"ghsa":[{"id":"GHSA-8gqp-hr9g-pg62","title":"Conductor vulnerable to OS command injection through unrestricted access to Java classes","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","status":"published","published":"2025-06-30T18:31:50Z","modified":"2025-06-30T22:16:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2025-26074","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","status":"published","published":"2025-06-30T17:15:31.987Z","modified":"2026-06-17T09:01:27.623Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:15.754475Z"}],"osv":[{"id":"GHSA-8gqp-hr9g-pg62","title":"Conductor vulnerable to OS command injection through unrestricted access to Java classes","description":"Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.","status":"published","published":"2025-06-30T18:31:50Z","modified":"2026-09-10T03:50:25.118781972Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}