CVE-2026-72530

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-72530 9.0

TrueConf · Server · Added 2026-08-20 · Published 2026-08-19

3-Day Required KEV Active Exploitation

Details

VulnerabilityTrueConf Server Code Injection Vulnerability

VendorTrueConf

ProductServer

Date added2026-08-20

Due date2026-09-03

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-94

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

NVD: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-20 18:26 UTC

Searches8

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-72530
https://trueconf.com/blog/news/security-fixes-updates-and-advisories
https://ics-cert.kaspersky.com/vulnerabilities/trueconf-server-missing-authentication-for-critical-function/
https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
https://advisory.eventussecurity.com/advisory/head-mare-compromises-trueconf-servers-while-targeting-conferencing-platforms-with-phantomcore-backdoor/
https://cvefeed.io/vuln/detail/CVE-2026-72530
https://basefortify.eu/cve_reports/2026/08/cve-2026-72530.html
https://www.strix.ai/cve/CVE-2026-72530

Hunting hypothesis agent

Hunt for attempts to escape TrueConf Server isolated execution environment via crafted scripts on port 4307, looking for privilege escalation to SYSTEM and web shell creation at locale.php.

Research details

ComponentIsolated execution environment / code generation module

PreconditionsNetwork reachability to port 4307/TCP; attacker must first achieve code execution within TrueConf Server's isolated environment (e.g., via CVE-2026-72529); then a specially crafted script escapes the sandbox to run arbitrary commands on the underlying OS as SYSTEM. Affected versions: 5.3.X before 5.3.9, 5.4.X before 5.4.9, 5.5.X before 5.5.5, and all versions before 5.3. agent

Public PoCno

Advisoryhttps://trueconf.com/blog/news/security-fixes-updates-and-advisories

Exploit notesCVSS attack complexity: HIGH (requires prior sandbox escape chain via CVE-2026-72529) | CRITICAL severity (CVSS >= 9.0) | Actively exploited in the wild by Head Mare group as second stage after CVE-2026-72529

SummaryTrueConf Server isolated execution environment allows sandbox escape via improper code generation management, enabling arbitrary code execution as SYSTEM. Head Mare chains this after CVE-2026-72529 to deploy PhantomCore and PhantomGraph backdoors and replace client installers with trojanized versions. Patched in versions 5.3.9, 5.4.9, and 5.5.5.

Tia coverage

First reported2026-08-20

First exploit report2026-08-20

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

trueconf-security-advisory-av26-835

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.