CVE-2026-72530 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-19

Added to CISA KEV: 2026-08-20 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in the CISA KEV catalog and is actively exploited by threat actors (Head Mare / PhantomCore). Immediately hunt for indicators of compromise — review server logs, check for unauthorized processes/backdoors, verify system integrity, and run full AV/EDR scans with up-to-date signatures per the vendor/Kaspersky ICS-CERT guidance.
Patch immediately: upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 (or later) depending on your branch. This is highest-priority remediation.
If patching cannot be performed immediately, restrict inbound access to TCP port 4307 to trusted internal IP ranges only and remove any public-internet exposure of the server management/service interface.
Monitor for anomalous connections to port 4307/TCP, unexpected outbound C2 traffic, and creation of new persistence mechanisms. If compromise indicators are found, rotate credentials for potentially affected accounts and engage incident response / Kaspersky ICS-CERT.
Patch priority: EMERGENCY / P1 — actively exploited, unauthenticated, critical RCE.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-72530 is a critical code injection vulnerability affecting TrueConf Server that allows a remote, unauthenticated attacker to escape an isolated environment and execute arbitrary code on the underlying host system. By sending a specially crafted script to the server via TCP port 4307, an attacker can gain unauthorized control over the system, making this a high-severity risk for any internet-facing deployment.

Exploitation

Active Exploitation: The vulnerability is confirmed to be exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog ^[2].
Threat Actors/Campaigns: Specific threat actors or named ransomware campaigns have not been publicly attributed to this CVE as of the current reporting.
Proof-of-Concept/Exploit Tooling: While exploit details (remote code execution via script upload) are publicly documented, specific functional exploit scripts are generally observed in malicious activity rather than benign research repositories.
Attack Prerequisites:

- Network Access: Required (remote access to port 4307/TCP). - Authentication: Not required (unauthenticated). - User Interaction: Not required.

Affected Products & Patches

Affected Versions: TrueConf Server versions 5.3.X (up to 5.3.9), 5.4.X (up to 5.4.9), and 5.5.X (up to 5.5.5) ^[3].
Patch/Hotfix: Users are advised to update to the latest patched version of TrueConf Server provided by the vendor.
Mitigation/Workarounds: If an immediate upgrade is not possible, organizations should restrict network access to TCP port 4307 to only trusted internal IP addresses or disable exposure of the server management interface to the public internet.

Impact

Capability: Successful exploitation results in remote code execution, granting the attacker the ability to execute arbitrary commands on the host server with the privileges of the application process.
Business Risk: For internet-facing deployments, this vulnerability provides a direct pathway for full system compromise, which may lead to data theft, unauthorized access to internal communications, installation of persistent malware or backdoors, and lateral movement within the corporate network ^[1].

Sources

CVE-2026-72530 - Critical Vulnerability - TheHackerWire
How severe is CVE-2026-72530? This vulnerability has a CVSS score of 9 out of 10, rated as Critical. Critical vulnerabilities can be exploited remotely without authentication and may lead to full system compromise, data theft, or malware installation. What Trueconf products are affected by CVE-2026-…
CVE-2026-72530: TrueConf Server Code Injection Vulnerability
CVE-2026-72530 affects TrueConf · Server. Exploited in the wild (CISA KEV). A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions… Severity, affected software, exploitation status, patch guidance and references.
NVD-CVE-2026-72530
CVE-2026-72530 Detail Description A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code…

🔴 CVE-2026-72530