Remote Code Execution Vulnerability in TrueConf Server by TrueConf
CVE-2026-72529

9.3CRITICAL

Key Information:

Vendor

Trueconf

Status
Trueconf Server
Vendor
CVE Published:
19 August 2026

What is CVE-2026-72529?

A remote code execution vulnerability exists in TrueConf Server, where an unauthorized attacker can exploit a lack of authentication for a critical undocumented function. Attackers with network access via port 4307/TCP can execute arbitrary scripts, compromising the integrity of the server and its operations. Administrators are urged to review their security measures and ensure that appropriate protections are in place to mitigate potential threats.

Affected Version(s)

TrueConf Server Windows * < 5.3

TrueConf Server Windows 5.3 < 5.3.9

TrueConf Server Windows 5.4 < 5.4.9

References

https://ics-cert.kaspersky.com/advisories/2026/08/11/true...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vyacheslav Kopeytsev from Kaspersky ICS CERT
.