CVE-2026-72530

This flaw lets an attacker use the TrueConf Server connection (on port 4307/TCP) to break out of a locked-down area and run any code they want on your server. Think of it like a “front door” call that tricks the building’s safety system and then gives the attacker the keys to the whole building. Because it has been exploited for real malware delivery, you should treat any exposure as an active risk.

This matters if your business runs TrueConf Server versions in the vulnerable ranges (up to the listed vulnerable releases) and the service is reachable on port 4307/TCP. It is not blocked by requiring a login, and it requires only network access to that port. The risk applies when attackers can reach that port from a network path (often the internet), and the server is running a vulnerable TrueConf Server version.

This is RED because confirmed real-world exploitation has been reported and CISA added CVE-2026-72530 to its Known Exploited Vulnerabilities catalog. Attackers can reach TrueConf Server over the network without authentication and run code on the server, which enables malware deployment and serious operational disruption. Act immediately—upgrade is the primary fix.

1. Confirm exposure (fast checks)

   • Identify your exact TrueConf Server version.
   • Determine whether port 4307/TCP is reachable from outside your organization (for example, test from an external network/VPS or review firewall/NAT rules).

2. Determine if you are vulnerable

   • You are in scope if you run a vulnerable TrueConf Server version per the advisory ranges (versions earlier than the fixed versions listed below).

3. Upgrade to the fixed version (primary remediation)

   • Upgrade TrueConf Server to one of the vendor-fixed versions:
     • 5.3.9.10013 (fixed)
     • 5.3.9 (fixed)
     • 5.4.9 (fixed)
     • 5.5.5 (fixed)
   • After upgrading, re-verify the service is running and that the listening port behavior is unchanged (still expect port 4307/TCP if the service configuration uses it).

4. Malware detection and response (do this even if you just upgraded)

   • Perform a full scan using antivirus software with up-to-date databases and modules.
   • Conduct an indicator-of-compromise scan.

5. If compromise is suspected or indicators are found

   • Change passwords for accounts that may have been compromised.
   • Contact Kaspersky ICS CERT at ics-cert@kaspersky.com for further instructions.

6. Timing guidance (CISA KEV)

   • CISA remediation due date for KEV-listed action: 2026-09-03.

7. What to monitor after remediation

   • Monitor the TrueConf Server host for signs of unexpected processes, repeated connection attempts to port 4307/TCP, and any unusual activity shortly after exposure windows.
   • Keep antivirus and scanning tools updated and continue periodic checks.

Severity is critical with a remote code execution impact pattern: an attacker with network access to port 4307/TCP can send a specially crafted script that enables escape from a containment/sandbox-like environment, resulting in arbitrary command execution on the host (CWE-94: Improper Control of Code Generation). Authentication and user interaction are not required per the findings. Exploitation status is confirmed: CISA KEV listing (added 2026-08-20) with a due date of 2026-09-03, and reporting indicates it was used to deploy PhantomCore malware (actor named in reports: Head Mare). No public exploit code is reported in the findings; EPSS is low in prediction, but it should not reduce urgency because KEV/news indicate active exploitation.