CVE-2025-26074
CVE-2025-26074 Remote Code Execution in Orkes
📅 PUBLISHED: 2025-06-30 00:00 UTC 🔄 UPDATED: 2026-09-24 06:00 UTC
⏳ SCORE PENDING — ANALYSIS IN PROGRESS
[ DEFENSE PATCH ↓ ]
💣 PoC: None
🎯 EPSS: 0.62%
VULNERABLE: UNKNOWN / CHECK VENDOR
CVSS SEVERITY SCALE
9.0–10.0 CRITICAL
7.0–8.9 HIGH
4.0–6.9 MEDIUM
0.1–3.9 LOW
0.0 NONE
SOON
PENDING NVD
Executive Summary
CVE-2025-26074 is a critical unauthenticated remote code execution (RCE) vulnerability in Orkes Conductor v3.21.11. The flaw stems from unrestricted access to Java classes, allowing an attacker to invoke arbitrary OS commands through the application’s API or workflow execution engine. With a CVSS score of 0.0 (placeholder) but a vector indicating network-based, low-complexity exploitation, this vulnerability poses a severe threat to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch is currently available, making immediate mitigation essential.
⚡ AUTOMATE YOUR CVE INTELLIGENCE
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian
›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.
›Shodan dorks — ready-made queries to find exposed vulnerable systems
›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)
›pending_fields — know exactly which of 7 fields NVD hasn't processed yet
›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits
PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026
[ FROM €19/MO ]
Free sandbox key available
No signup required
No signup required
Supply Chain & Package Security
This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects a Java-based orchestration platform. Organizations using Orkes Conductor should treat this as a critical supply chain risk, as the software may be deployed as a managed service or self-hosted component.
CVSS Breakdown & Threat Level
- Attack Vector (AV): Network (N) – Exploitable remotely.
- Attack Complexity (AC): Low (L) – No special conditions required.
- Privileges Required (PR): None (N) – No authentication needed.
- User Interaction (UI): None (N) – No user action required.
- Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
- Confidentiality (C): High (H) – Full system compromise.
- Integrity (I): High (H) – Arbitrary code execution.
- Availability (A): High (H) – Potential denial of service.
Threat Level: Critical. The combination of network access, low complexity, and no authentication makes this a prime target for automated exploitation.
Deep Dive & Mechanics
The vulnerability exists in Orkes Conductor’s workflow execution engine, which allows users to define tasks using Java classes. Due to insufficient sandboxing or class filtering, an attacker can supply a malicious Java class that executes OS commands. The application does not restrict which Java classes can be instantiated or which methods can be called, enabling arbitrary command injection.
Attack Vector:
- An attacker sends a crafted HTTP request to the Conductor API (e.g.,
/api/workflowor task definition endpoints). - The request includes a task definition that references a Java class capable of executing system commands (e.g.,
java.lang.Runtimeorjava.lang.ProcessBuilder). - The Conductor server instantiates the class and invokes methods, leading to OS command execution.
Root Cause: Lack of a whitelist or blacklist for allowed Java classes in task definitions.
Vulnerable vs. Patched Code
Vulnerable Code (v3.21.11):
// Example of vulnerable task execution
public class TaskRunner {
public void executeTask(Task task) {
String className = task.getClassName();
Class<?> clazz = Class.forName(className);
Object instance = clazz.getDeclaredConstructor().newInstance();
// No validation of className
Method method = clazz.getMethod("execute");
method.invoke(instance);
}
}
Patched Code (Hypothetical):
// Example of patched code with class whitelist
public class TaskRunner {
private static final Set<String> ALLOWED_CLASSES = Set.of(
"com.orkes.tasks.HttpTask",
"com.orkes.tasks.LogTask"
);
public void executeTask(Task task) {
String className = task.getClassName();
if (!ALLOWED_CLASSES.contains(className)) {
throw new SecurityException("Class not allowed: " + className);
}
Class<?> clazz = Class.forName(className);
Object instance = clazz.getDeclaredConstructor().newInstance();
Method method = clazz.getMethod("execute");
method.invoke(instance);
}
}
Exploitation & Lab Setup
Red Team (Attack Simulation)
Prerequisites:
- Orkes Conductor v3.21.11 running on a test environment.
- Network access to the Conductor API (default port 8080).
Exploit Steps:
- Identify the API endpoint for task definitions (e.g.,
POST /api/taskdefs). - Craft a malicious task definition that uses
java.lang.Runtime:
{
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds": 30,
"inputKeys": [],
"outputKeys": [],
"timeoutPolicy": "TIME_OUT_WF",
"retryLogic": "FIXED",
"retryDelaySeconds": 0,
"responseTimeoutSeconds": 30,
"concurrentExecLimit": 1,
"rateLimitPerFrequency": 0,
"rateLimitFrequencyInSeconds": 1,
"ownerEmail": "attacker@example.com",
"pollTimeoutSeconds": 30,
"taskReferenceName": "malicious_task_ref",
"workflowTask": {
"name": "malicious_task",
"taskReferenceName": "malicious_task_ref",
"type": "SIMPLE",
"inputParameters": {},
"startDelay": 0,
"optional": false,
"taskDefinition": {
"name": "malicious_task",
"retryCount": 0,
"timeoutSeconds":
◈ SOURCE
Analysis & enrichment: valtersit.com/cve/CVE-2025-26074/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub