Cybersecurity

CISA Gives TrueConf Users 3 Days to Patch Two Flaws

CISA added two actively exploited TrueConf Server flaws to its Known Exploited Vulnerabilities catalog on August 20, 2026, giving federal agencies three days to patch an unauthenticated remote code execution hole.

CybersecurityBy Servola Tech Desk2026-08-213 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

CISA Gives TrueConf Users 3 Days to Patch Two Flaws

A Three-Day Clock Starts on Two Critical Holes

CISA added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog on August 20, 2026, and gave federal civilian agencies until August 23 to patch them.

Both flaws carry critical severity scores, both are already being exploited, and neither requires a password: an attacker who can reach TrueConf Server's port 4307 over the network can compromise it without ever logging in.

What CVE-2026-72529 and CVE-2026-72530 Actually Do

The first flaw, CVE-2026-72529, is a missing-authentication bug: TrueConf Server exposes an undocumented function on port 4307/TCP that lets an unauthenticated remote attacker execute an arbitrary script, no credentials required.

CVE	Type	Affected versions	Patched in
CVE-2026-72529	Missing authentication, unauthenticated remote code execution via an undocumented function on port 4307/TCP	5.3.x-5.3.9, 5.4.x-5.4.9, 5.5.x-5.5.5 and earlier	5.3.9 / 5.4.9 / 5.5.5
CVE-2026-72530	Code injection allowing an attacker to break out of the server's sandbox and run code on the host	5.3.x-5.3.9, 5.4.x-5.4.9, 5.5.x-5.5.5 and earlier	5.3.9 / 5.4.9 / 5.5.5

The second flaw, CVE-2026-72530, is a code injection bug that lets an attacker who has already reached the server break out of its isolated environment and run arbitrary code directly on the host machine, turning a contained bug into full server control.

Kaspersky Traces Active Exploitation to Trojanized Installers

Kaspersky's ICS CERT team documented attackers exploiting this exact vulnerability chain to replace legitimate TrueConf client installers with poisoned versions carrying the PhantomCore and PhantomGraph backdoors.

Kaspersky attributed the campaign to a group it tracks as Head Mare and said the poisoned installers were first detected in July 2026, delivered through compromised TrueConf servers to unsuspecting meeting participants who trusted the update.

The Sovereignty Pitch Meets an Unlocked Front Door

TrueConf markets its on-premises deployment as the answer for organizations that want video conferencing off US cloud infrastructure entirely, pitching itself directly at government, healthcare and financial customers with strict data-localization rules.

That pitch is not wrong, but it is incomplete: a self-hosted server run to avoid depending on a foreign cloud vendor still needs the same patching discipline that cloud vendor promised to handle, and an unauthenticated hole on an internet-facing port is a worse starting position than most misconfigured cloud accounts.

What to Do Before Monday

Any organization running TrueConf Server on 5.3.x, 5.4.x or 5.5.x should check its version now and upgrade to 5.3.9, 5.4.9 or 5.5.5 immediately, since all three release lines already contain the fix.

Where an immediate upgrade is not possible, restricting network access to port 4307 and auditing recent server logs for the undocumented function call are the minimum stopgaps until the patch is applied.

Frequently asked questions

What is TrueConf Server?

TrueConf Server is a self-hosted video conferencing platform that organizations install on their own infrastructure instead of using a cloud provider like Zoom, Microsoft Teams or Google Meet.

What do CVE-2026-72529 and CVE-2026-72530 let an attacker do?

CVE-2026-72529 lets an unauthenticated attacker run a script on the server with no login at all, and CVE-2026-72530 lets an attacker already on the server break out and run code on the host.

Which TrueConf Server versions are affected?

Versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5 and earlier are affected, and versions 5.3.9, 5.4.9 and 5.5.5 already contain the fix.

Why does CISA's deadline matter to organizations outside the United States?

CISA's Known Exploited Vulnerabilities catalog is a global signal of confirmed active exploitation, so any organization running the affected versions faces the same risk regardless of where its federal deadline applies.

Who is currently exploiting these flaws?

Kaspersky's ICS CERT team linked active exploitation to a group it tracks as Head Mare, which has been trojanizing TrueConf client installers with the PhantomCore and PhantomGraph backdoors.

Self-hosting a conferencing server is a legitimate way to keep data off someone else's cloud, but it transfers the entire patching burden to whoever runs that server, and a three-day-old critical hole with no login required is not a problem next sprint can absorb.

CISATrueConfKnown Exploited VulnerabilitiesSelf-Hosted InfrastructurePatch Management

Gunra Ransomware Runs on Fortinet Bugs Patched in 2025

CISA, the FBI, NSA and South Korea jointly named Gunra ransomware on August 10. It breaks in through two Fortinet flaws patched over a year ago. The real finding is patch lag, not the malware.

3 min read

Cybersecurity

TeamCity Flaw Lets Attackers Own Your Build Pipeline

CISA confirms active exploitation of CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity On-Premises. CVSS 9.8, KEV-listed 5 August, FCEB deadline 8 August.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles