Remote Code Execution Vulnerability in TrueConf Server by TrueConf
CVE-2026-72530

9.5CRITICAL

Key Information:

Vendor

Trueconf

Status
Trueconf Server
Vendor
CVE Published:
19 August 2026

Badges

👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2026-72530?

A vulnerability in TrueConf Server allows remote unauthorized attackers with access to port 4307/TCP to exploit the server versions 5.3.X up to 5.3.9, 5.4.X up to 5.4.9, and 5.5.X up to 5.5.5. By using a crafted script, the attacker can break out of the isolated execution environment and execute arbitrary code on the host system, posing significant security risks to affected systems.

CISA has reported CVE-2026-72530

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-72530 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

TrueConf Server Windows * < 5.3

TrueConf Server Windows 5.3 < 5.3.9

TrueConf Server Windows 5.4 < 5.4.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-72530-TrueConf-Sandbox-Escape-
Created by fevar54

News Articles

favicon imageSC Media

TrueConf flaws enabling attacks on meeting participants added to KEV catalog

The flaws have been used by the Head Mare APT hacktivist group to spread PhantomCore malware.

3 weeks ago

favicon imageBleepingComputer

CISA orders feds to patch actively exploited TrueConf Server flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform.

3 weeks ago

References

https://ics-cert.kaspersky.com/advisories/2026/08/11/true...
third-party-advisory

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 📰

    First article discovered by BleepingComputer

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vyacheslav Kopeytsev from Kaspersky ICS CERT
.