The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in TrueConf Server, an on-premises video conferencing and unified communications platform, to its Known Exploited Vulnerabilities (KEV) catalog. The flaws, identified as CVE-2026-72529 and CVE-2026-72530, both carry high CVSS scores, indicating their severity.
TrueConf Server is designed for organizations that require secure, self-hosted communication solutions, including video meetings, voice calls, messaging, and collaboration, without full reliance on cloud services. It is commonly used by businesses, government entities, and other institutions prioritizing control over their communication infrastructure and data.
CVE-2026-72529, with a CVSS score of 9.3, is described as a missing authentication vulnerability for a critical function. This flaw allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function. The vulnerability affects TrueConf Server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and all earlier iterations. Exploitation of this vulnerability could enable an attacker to compromise the server and potentially gain a foothold within the affected network.
The second vulnerability, CVE-2026-72530, has an even higher CVSS score of 9.5 and is a code injection vulnerability that facilitates a sandbox escape. This flaw also permits an unauthenticated remote attacker with network access to TCP port 4307 to bypass the isolated environment and execute arbitrary code on the underlying host system. It impacts the same TrueConf Server versions as CVE-2026-72529: 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier. By sending a specially crafted script, an attacker could escape the restricted environment, achieve code execution on the host, and potentially achieve a full server compromise.
Both vulnerabilities were discovered by Vyacheslav Kopeytsev of Kaspersky ICS CERT. The primary concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a direct path to execute code on the server.
Under Binding Operational Directive (BOD) 22-01, which focuses on reducing the significant risk of known exploited vulnerabilities, U.S. Federal Civilian Executive Branch (FCEB) agencies are mandated to address these identified vulnerabilities by specific deadlines. CISA has ordered federal agencies to fix CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2, 2026. Experts also advise private organizations to review the KEV catalog and remediate these vulnerabilities within their own infrastructure to protect against potential attacks.
