{"id":"trueconf-server-exploited-flaws-aug-2026","category":"patch","status":"closed","title":"TrueConf Server flaws CVE-2026-72529 and CVE-2026-72530 exploited to spread malware; fixes available","tldr":"Two critical TrueConf Server flaws let attackers run code without a password. Compromised servers also delivered malware to meeting participants. Update servers to the fixed builds and ask IT to check servers and attendees' computers for compromise.","summary":"Two critical flaws affect organisations running TrueConf Server for messaging and video meetings on Windows or Linux. CVE-2026-72529 permits script execution without signing in; CVE-2026-72530 lets code escape the server's isolated environment and run on its underlying operating system. Attackers need network access to the server's service on TCP port 4307. Fixes were released in June in the 5.3.9, 5.4.9 and 5.5.5 branches; TrueConf specifies the required Windows and Linux builds below. Kaspersky subsequently linked attacks against Russian organisations to Head Mare and found compromised servers distributing Windows installers containing PhantomCore malware. People joining another organisation's meeting could therefore be affected too. CISA listed both flaws as exploited on 20 August. As of 3 November, fixes are available for all three listed branches, but the reviewed sources do not establish the number of victims or confirm that compromised systems have all been cleaned.","action":"Ask whoever manages your organisation's TrueConf Server to install a current supported release meeting the fixed build numbers below and check for signs of compromise. If you installed TrueConf from a work or adviser's meeting link, ask their IT team whether your computer needs checking. Kaspersky recommends a full antivirus scan and changing affected account passwords if compromise is detected.","product":"TrueConf Server for Windows and Linux","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-72529","CVE-2026-72530"],"tags":["trueconf","video-conferencing","authentication-bypass","remote-code-execution","actively-exploited","phantomcore"],"affected":["TrueConf Server before 5.3","TrueConf Server 5.3.x before 5.3.9","TrueConf Server 5.4.x before 5.4.9","TrueConf Server 5.5.x before 5.5.5"],"fixed":["TrueConf Server 5.3.9.10013 or later (Windows)","TrueConf Server 5.3.9.10015 or later (Linux)","TrueConf Server 5.4.9.10018 or later (Windows)","TrueConf Server 5.4.9.10019 or later (Linux)","TrueConf Server 5.5.5.10010 or later (Windows)","TrueConf Server 5.5.5.10009 or later (Linux)"],"matches":[],"sources":[{"kind":"advisory","title":"TrueConf Security Vulnerabilities, Fixes and Advisories","url":"https://trueconf.com/blog/news/security-fixes-updates-and-advisories","by":"TrueConf","date":"2026-06-11"},{"kind":"advisory","title":"KLCERT-26-057: TrueConf Server. Missing authentication for critical function","url":"https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/","by":"Kaspersky ICS CERT","date":"2026-08-11"},{"kind":"advisory","title":"KLCERT-26-058: TrueConf Server. Breakout from isolated environment","url":"https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/","by":"Kaspersky ICS CERT","date":"2026-08-11"},{"kind":"research","title":"Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participants","url":"https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/","by":"Kaspersky ICS CERT","date":"2026-08-12"},{"kind":"advisory","title":"TrueConf security advisory (AV26-835)","url":"https://www.cyber.gc.ca/en/alerts-advisories/trueconf-security-advisory-av26-835","by":"Canadian Centre for Cyber Security","date":"2026-08-20"}],"started":"2026-08-20","closed":"2026-08-20","created":"2026-11-03T22:16:34.255Z","updated":"2026-11-03T22:16:34.255Z","cve_notes":[{"cve":"CVE-2026-72529","name":"Missing authentication in TrueConf Server","what":"A missing authentication check in TrueConf Server's network service allows an attacker who can reach it to run a script without signing in.","severity":"critical","cvss":9.8},{"cve":"CVE-2026-72530","name":"Sandbox escape in TrueConf Server","what":"A code-generation flaw in TrueConf Server's isolated execution environment lets an attacker already running code there escape its restrictions and run commands on the host operating system.","severity":"critical","cvss":9}],"timeline":[{"at":"2026-08-20","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre confirmed both additions and urged administrators to apply updates.","url":"https://www.cyber.gc.ca/en/alerts-advisories/trueconf-security-advisory-av26-835","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-08-12","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Kaspersky reported attacks linked to Head Mare against Russian organisations. Compromised servers distributed altered Windows client installers that infected meeting participants with PhantomCore malware; Kaspersky said it was coordinating user notification with TrueConf.","url":"https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/","by":"Kaspersky ICS CERT","patch":null},{"at":"2026-08-11","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Kaspersky's two advisories described unauthenticated script execution and escape from the server's isolated environment on Windows and Linux. Both pages are dated 11 August, although their embedded timelines give 7 August as the publication date.","url":"https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/","by":"Kaspersky ICS CERT","patch":null},{"at":"2026-06-18","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"TrueConf released Server 5.3.9, 5.4.9 and 5.5.5 with fixes for both flaws, according to Kaspersky's subsequent investigation.","url":"https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/","by":"Kaspersky ICS CERT","patch":"patched"}],"url":"https://hard.fyi/live/trueconf-server-exploited-flaws-aug-2026/","json":"https://hard.fyi/api/live?id=trueconf-server-exploited-flaws-aug-2026"}