CVE-2026-72529

This is a hole that lets someone take remote control of your TrueConf Server process and run their own scripts on it—no login required. Think of it like leaving a back door unlocked in a locked building, and attackers can push a button on the outside to make the building run whatever instructions they provide.

This matters to you if you run TrueConf Server (especially if it’s reachable on TCP port 4307). Because exploitation is confirmed and the flaw requires no login, any exposure to network traffic on that port meaningfully increases risk. Treat this as urgent when the server is reachable from the internet or other untrusted networks via port 4307.

This is RED because attackers are actively exploiting CVE-2026-72529 in the real world, and it was added to CISA’s Known Exploited Vulnerabilities catalog. You should act immediately to block network exposure on port 4307 and upgrade to a fixed TrueConf Server version before further compromise attempts succeed.

1. Confirm exposure (fast check)

   • Determine the TrueConf Server machine(s).
   • Verify whether TCP/4307 is reachable from outside your organization (internet) or from untrusted networks.
   • If you have admin access, run an external port test from a system not on your trusted network, or check perimeter/firewall rules that control TCP/4307.

2. Confirm whether you are affected (version check)

   • Identify your installed TrueConf Server version.
   • Versions affected include TrueConf Server 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier (as described in the findings).

3. Upgrade to the fixed version (preferred remediation)

   • Upgrade to one of the fixed versions provided by the vendor findings:
     • For the 5.3 branch: upgrade to 5.3.9.10013
     • For the 5.4 branch: upgrade to 5.4.9
     • For the 5.5 branch: upgrade to 5.5.5
   • After upgrading, re-check that TCP/4307 is only accessible from approved networks.

4. Temporary mitigation if you cannot upgrade immediately

   • Block/disable inbound access to TCP port 4307 from the internet and any untrusted networks (isolate or restrict at the firewall/network layer).

5. Incident-style verification (even if you patch)

   • Run a full antivirus scan using up-to-date definitions.
   • Conduct a scan for indicators of compromise.
   • If indicators are found: change passwords for accounts that may have been compromised and contact Kaspersky ICS CERT at ics-cert@kaspersky.com for further instructions (per the vendor workaround findings).

6. Follow timing guidance

   • CISA KEV remediation due date for this CVE is 2026-08-23.

7. What to monitor after changes

   • Monitor for unusual process/script activity on the TrueConf Server host.
   • Keep an eye on attempts to reach TCP/4307 from outside approved networks (connection logs/firewall logs).

CVE-2026-72529 is a remote, unauthenticated vulnerability in TrueConf Server (CWE-306: missing authentication for critical functionality). The weakness allows an attacker to execute arbitrary scripts remotely by invoking a hidden/undocumented function over TCP port 4307/TCP.

Exploitation status: This is not hypothetical—CISA’s KEV catalog lists the issue as exploitable, with active exploitation reported. The KEV entry was added on 2026-08-20, and CISA set a remediation due date of 2026-08-23. Reporting indicates attackers (Head Mare) have been using the flaw to deliver malware (PhantomCore) and/or escape sandboxing.

Exploit availability: No public exploit code was found/recorded in the provided findings, but that does not reduce risk given confirmed exploitation.

Risk forecasting note: EPSS is provided in the findings, but because KEV/news confirm active exploitation, exploitation likelihood in practice is treated as confirmed; the EPSS value should not be used to down-rank urgency.

Fixed versions (from findings): 5.3.9.10013, 5.4.9, and 5.5.5, depending on the branch.