TrueConf Server flaws CVE-2026-72529 and CVE-2026-72530 exploited to spread malware; fixes available
Two critical TrueConf Server flaws let attackers run code without a password. Compromised servers also delivered malware to meeting participants. Update servers to the fixed builds and ask IT to check servers and attendees' computers for compromise.
Ask whoever manages your organisation's TrueConf Server to install a current supported release meeting the fixed build numbers below and check for signs of compromise. If you installed TrueConf from a work or adviser's meeting link, ask their IT team whether your computer needs checking. Kaspersky recommends a full antivirus scan and changing affected account passwords if compromise is detected.
What’s happening
Two critical flaws affect organisations running TrueConf Server for messaging and video meetings on Windows or Linux. CVE-2026-72529 permits script execution without signing in; CVE-2026-72530 lets code escape the server's isolated environment and run on its underlying operating system. Attackers need network access to the server's service on TCP port 4307. Fixes were released in June in the 5.3.9, 5.4.9 and 5.5.5 branches; TrueConf specifies the required Windows and Linux builds below. Kaspersky subsequently linked attacks against Russian organisations to Head Mare and found compromised servers distributing Windows installers containing PhantomCore malware. People joining another organisation's meeting could therefore be affected too. CISA listed both flaws as exploited on 20 August. As of 3 November, fixes are available for all three listed branches, but the reviewed sources do not establish the number of victims or confirm that compromised systems have all been cleaned.
- What
- Flaw
- Affects
- TrueConf Server for Windows and Linux
- Affected
- TrueConf Server before 5.3
TrueConf Server 5.3.x before 5.3.9
TrueConf Server 5.4.x before 5.4.9
TrueConf Server 5.5.x before 5.5.5 - Fixed in
- TrueConf Server 5.3.9.10013 or later (Windows)
TrueConf Server 5.3.9.10015 or later (Linux)
TrueConf Server 5.4.9.10018 or later (Windows)
TrueConf Server 5.4.9.10019 or later (Linux)
TrueConf Server 5.5.5.10010 or later (Windows)
TrueConf Server 5.5.5.10009 or later (Linux) - Since
- 20 Aug 2026
- Closed
- 20 Aug 2026
Timeline
- CISA added
CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre confirmed both additions and urged administrators to apply updates.
- Made public
Kaspersky reported attacks linked to Head Mare against Russian organisations. Compromised servers distributed altered Windows client installers that infected meeting participants with PhantomCore malware; Kaspersky said it was coordinating user notification with TrueConf.
- Made public
Kaspersky's two advisories described unauthenticated script execution and escape from the server's isolated environment on Windows and Linux. Both pages are dated 11 August, although their embedded timelines give 7 August as the publication date.
- New fixFixed
TrueConf released Server 5.3.9, 5.4.9 and 5.5.5 with fixes for both flaws, according to Kaspersky's subsequent investigation.
Sources
- TrueConf Security Vulnerabilities, Fixes and AdvisoriesTrueConf · 11 June 2026
- KLCERT-26-057: TrueConf Server. Missing authentication for critical functionKaspersky ICS CERT · 11 Aug 2026
- KLCERT-26-058: TrueConf Server. Breakout from isolated environmentKaspersky ICS CERT · 11 Aug 2026
- Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware to conference participantsKaspersky ICS CERT · 12 Aug 2026
- TrueConf security advisory (AV26-835)Canadian Centre for Cyber Security · 20 Aug 2026