CISA Orders Urgent Patching of TrueConf Server Flaws Being Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal civilian agencies to prioritize remediating two actively exploited vulnerabilities in TrueConf Server — a self-hosted platform for enterprise communications and video conferencing. Unlike cloud services such as Zoom or Microsoft Teams, TrueConf Server is deployed inside an organization's local network.

Two critical holes

The first and most dangerous vulnerability (CVE-2026-72529) stems from a missing authentication check. As explained by the TrueConf security team, a remote, unauthenticated attacker who connects to the server on port 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server.

The second vulnerability (CVE-2026-72530) is also rated critical. Through a complex code-injection attack, an adversary who has already achieved code execution within TrueConf Server's isolated environment is able to break out of the “sandbox” and run arbitrary commands in the host operating system.

On Thursday, CISA added both holes to its Known Exploited Vulnerabilities (KEV) catalog and ordered agencies of the federal civilian executive branch to protect their servers within a two-week window — by September 3. The agency noted that vulnerabilities of this kind are a regular attack vector and pose significant risks to federal infrastructure.

Attacks on Russian companies

CISA did not disclose details of the attacks, but Kaspersky Lab reported that the Head Mare group has been exploiting CVE-2026-72529 and CVE-2026-72530 since at least July 2026. The attackers replaced client installers with malicious versions that deploy a backdoor. According to Kaspersky, the Head Mare campaigns were aimed at Russian organizations across various sectors — in transport, energy, IT, electronics and software development.

This is not the first time TrueConf has come under attack. In April 2026, Check Point Research reported the exploitation of another platform vulnerability (CVE-2026-3502) as part of the “Operation True Chaos” zero-day campaign, which was linked to Chinese hackers: users were compromised through trojanized client updates.

Source: Bleeping Computer