CVE-2026-72529

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-72529 9.8

TrueConf · Server · Added 2026-08-20 · Published 2026-08-19

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityTrueConf Server Missing Authentication for Critical Function Vulnerability

VendorTrueConf

ProductServer

Date added2026-08-20

Due date2026-08-23

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

NVD: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-20 18:26 UTC

Searches8

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-72529
https://trueconf.com/blog/news/security-fixes-updates-and-advisories
https://ics-cert.kaspersky.com/vulnerabilities/trueconf-server-missing-authentication-for-critical-function/
https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
https://github.com/advisories/ghsa-xc2x-q39j-746f
https://advisory.eventussecurity.com/advisory/head-mare-compromises-trueconf-servers-while-targeting-conferencing-platforms-with-phantomcore-backdoor/
https://cvefeed.io/vuln/detail/CVE-2026-72529
https://app.opencve.io/cve/CVE-2026-72529

Hunting hypothesis agent

Hunt for unauthenticated TCP connections to port 4307 on TrueConf Server hosts, monitoring for calls to undocumented API functions that trigger script execution and web shell deployment.

Research details

ComponentUndocumented API endpoint on TCP port 4307

PreconditionsNetwork reachability to port 4307/TCP on the TrueConf Server host; no authentication required; affected versions: 5.3.X before 5.3.9, 5.4.X before 5.4.9, 5.5.X before 5.5.5, and all versions before 5.3. The attacker invokes an undocumented critical function over the open port to execute arbitrary scripts within the server process. agent

Public PoCno

Advisoryhttps://trueconf.com/blog/news/security-fixes-updates-and-advisories

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Port 4307/TCP is open by default and requires no authentication | Actively exploited in the wild by Head Mare group chaining with CVE-2026-72530

SummaryTrueConf Server exposes an undocumented API on TCP port 4307 without authentication, allowing unauthenticated remote attackers to execute arbitrary scripts. Head Mare APT group actively chains this with CVE-2026-72530 to gain SYSTEM privileges and deploy PhantomCore backdoors. Patched in versions 5.3.9, 5.4.9, and 5.5.5.

Tia coverage

First reported2026-08-20

First exploit report2026-08-20

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

trueconf-security-advisory-av26-835

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.