CVE-2026-72529

CVE-2026-72529 is a missing-authentication vulnerability (CWE-306) in TrueConf Server that lets a remote, unauthenticated attacker reach an undocumented function over TCP port 4307 and execute an arbitrary script on the server. It is triggered simply by sending crafted requests to that port on an affected build, with no credentials or user interaction required. Successful exploitation yields code execution with high impact on the server's confidentiality, integrity, and availability (CVSS 4.0 base score 9.3). Any organization running TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, or earlier versions is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20, and a public Kaspersky (Securelist) report documents the Head Mare threat actor targeting TrueConf Server with the PhantomCore backdoor, confirming in-the-wild exploitation; EPSS currently estimates a 1.6% chance of exploitation in the next 30 days.

What to do: Upgrade all TrueConf Server deployments to a release newer than 5.5.5 (the highest listed affected version) per vendor instructions, and until patched restrict access to TCP port 4307 from untrusted networks and confirm the server is not internet-exposed. Federal agencies must apply mitigations consistent with CISA BOD 26-04 or discontinue use of the product. Hunt for compromise indicators on affected servers, since Head Mare has been observed exploiting this flaw to deploy the PhantomCore backdoor.