CISA adds exploited TrueConf Server RCEs with an August 23 deadline

AI-generated: This article was created and published automatically by LinkLoot and was not substantively reviewed by a human editor.

CISA added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog on August 20, 2026. Federal civilian agencies must address CVE-2026-72529 by August 23; CVE-2026-72530 carries a September 3 deadline. Both flaws can lead to remote code execution on exposed conferencing servers.

The deadlines formally apply to U.S. federal civilian agencies under CISA's binding directive. Other organizations running TrueConf Server should treat the catalog entry as evidence of exploitation in the wild, not as a general legal deadline.

The TrueConf flaws form a remote execution chain

CVE-2026-72529 is a missing-authentication flaw in a critical function. CISA says an unauthenticated attacker with network access to TCP port 4307 can execute an arbitrary script. CVE-2026-72530 is a code-injection flaw that lets a crafted script escape TrueConf's isolated environment and run arbitrary code on the host.

BleepingComputer's independent report connects the flaws to activity tracked by Kaspersky as KLCERT-26-057 and KLCERT-26-058. In observed attacks, the Head Mare group escalated to NT AUTHORITY\\SYSTEM, installed a web shell, and replaced the legitimate TrueConf Client installer with a trojanized package carrying the PhantomCore backdoor.

Patch versions and temporary containment

The affected range includes TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older releases. Upgrade each branch to at least 5.3.9, 5.4.9, or 5.5.5; use a newer supported version when available.

If an immediate upgrade is impossible, block untrusted inbound access to TCP port 4307. That reduces exposure but does not clean an already compromised server. Organizations on older 5.0–5.2 releases should follow TrueConf's upgrade guidance and contact vendor support where the migration path requires it.

Hunt for backdoored servers and client installers

Patching closes the known entry path, but the reported campaign establishes persistence and turns the conferencing server into a client-distribution channel. Response teams should therefore check for:

• unexpected changes to \\public\\js\\locale.php or other web-accessible files;
• SysExcSvc.dll and SysReadSvc.dll, associated with the PhantomGraph backdoor;
• suspicious LSASS access, reverse SSH tunnels, and unusual OneDrive API traffic from the server;
• unsigned or modified TrueConf Client installers distributed by internal servers.

Rebuild from trusted media and rotate exposed credentials if compromise is plausible. A clean version number alone does not prove that an attacker failed to establish persistence before the upgrade.

Why the August 23 date matters

CISA gave federal agencies only three days for CVE-2026-72529, reflecting the risk of unauthenticated remote script execution on a service that may bridge external meeting traffic and internal client updates. Defenders should inventory TrueConf deployments now, including servers owned by contractors or counterparties that employees use for meetings.

The next concrete milestone is August 23. By then, affected federal systems must be remediated, and private operators should at minimum have restricted port 4307, verified patch levels, and begun compromise hunting.