U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog
CISA added two exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog with federal patch deadlines.
CISA added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-72529 (CVSS 9.3), a missing-authentication remote code execution flaw reachable on TCP port 4307, and CVE-2026-72530 (CVSS 9.5), a sandbox escape allowing code execution on the underlying host. Both flaws affect TrueConf Server versions 5.3.x through 5.5.5 and earlier, and were discovered by Vyacheslav Kopeytsev of Kaspersky ICS CERT. Under BOD 22-01, federal civilian agencies must patch CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2, 2026.
- CVE-2026-72529 (CVSS 9.3) allows unauthenticated RCE via an undocumented function on TCP port 4307.
- CVE-2026-72530 (CVSS 9.5) is a sandbox escape enabling arbitrary code execution on the host.
- Flaws affect TrueConf Server 5.3.x through 5.5.5 and earlier on-premises deployments.
- Federal agencies face patch deadlines of August 23 and September 2, 2026 under BOD 22-01.
- Compromised servers could serve as entry points into affected networks.
- Products
- TrueConf Server
- Organizations
- CISAKaspersky ICS CERT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-72530+1 related CVE | Code Injection Sandbox Escape in TrueConf Server Allows Host RCE via TCP 4307 | 9.5 group max | 2% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.