Remote Code Execution Vulnerability in TrueConf Server by TrueConf
CVE-2026-72530

9.5CRITICAL

Key Information:

Vendor

Trueconf

Status
Trueconf Server
Vendor
CVE Published:
19 August 2026

What is CVE-2026-72530?

A vulnerability in TrueConf Server allows remote unauthorized attackers with access to port 4307/TCP to exploit the server versions 5.3.X up to 5.3.9, 5.4.X up to 5.4.9, and 5.5.X up to 5.5.5. By using a crafted script, the attacker can break out of the isolated execution environment and execute arbitrary code on the host system, posing significant security risks to affected systems.

Affected Version(s)

TrueConf Server Windows * < 5.3

TrueConf Server Windows 5.3 < 5.3.9

TrueConf Server Windows 5.4 < 5.4.9

References

https://ics-cert.kaspersky.com/advisories/2026/08/11/true...
third-party-advisory

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vyacheslav Kopeytsev from Kaspersky ICS CERT
.