Overview
- CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV catalog on Friday, August 21, 2026 and ordered federal agencies to apply patches on a near-term schedule.
- The two flaws let unauthenticated remote attackers who can reach TrueConf Server on TCP port 4307 execute scripts inside the product and escape its sandbox to run code on the host.
- TrueConf issued fixes in June 2026 in versions 5.3.9, 5.4.9 and 5.5.5 and owners are urged to update, restrict access to port 4307, scan for indicators of compromise, and rotate breached credentials.
- Kaspersky reported active exploitation by the hacktivist group Head Mare that chained the two bugs to place web shells, replace official client installers, and distribute PhantomCore backdoors to participant devices.
- Beyond immediate patching, organizations should verify the integrity of TrueConf’s web root and client installers, hunt for altered files and suspicious services, and treat tampered client updates as a potential supply-chain compromise.