by Kastro
Paper/Archive/CVE-2026-72529

CVE-2026-72529

TrueConf TrueConf Server — TrueConf Server Missing Authentication for Critical Function Vulnerability

KEV · due 23 AugEPSS 1%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
94
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 73.6.736 × 2014.7Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Affected

ProductAffectedFixed inSource
TrueConf Server< 5.35.3CNA
TrueConf Server5.3 – < 5.3.95.3.9CNA
TrueConf Server5.4 – < 5.4.95.4.9CNA
TrueConf Server5.5 – < 5.5.55.5.5CNA

Scores by source

Kaspersky (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kaspersky (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeupics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-functionrefsecurelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529kevcisa.gov/known-exploited-vulnerabilities-catalog