CISA Orders Rapid Patching of Actively Exploited TrueConf Server Flaws

Overview

• On Thursday CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog and set federal deadlines to remediate the first by August 23 and the second by September 2.
• CVE-2026-72529 lets an unauthenticated remote attacker invoke an undocumented function to execute arbitrary scripts and CVE-2026-72530 lets an attacker escape a sandbox to run code on the host when the TrueConf service is reachable on TCP/4307.
• TrueConf issued fixes for the affected 5.3.x, 5.4.x and 5.5.x series in June 2026 in versions 5.3.9, 5.4.9 and 5.5.5 and owners are urged to apply those updates immediately.
• Kaspersky reported that the hacktivist group Head Mare has exploited the flaws to install web shells, replace client installers, gain privileged database access and deploy PhantomCore backdoors in observed incidents.
• Operators who cannot patch right away should block public access to TCP/4307, scan servers for indicators of compromise, remove any malicious installers or shells found, and rotate credentials to limit ongoing access.