CVE-2026-72529

9.5 CISA KEV

TrueConf · Server

TrueConf Server contains a vulnerability involving missing authentication for critical functions, which allows unauthorized remote attackers to perform sensitive actions.

Executive summary

TrueConf Server is vulnerable to an unauthenticated critical function access flaw that is currently being exploited in the wild.

Vulnerability

This vulnerability, categorized as CWE-306, allows an unauthenticated remote attacker to bypass security controls and execute critical functions on the server. The lack of proper authentication checks exposes the administrative interface to unauthorized interaction.

Business impact

The potential for unauthenticated access to critical server functions poses a severe risk to organizational data and infrastructure integrity. With a CVSS score of 9.5, this vulnerability represents a critical threat level that could lead to full system compromise, unauthorized data exfiltration, or complete service disruption.

Remediation

Immediate Action: Update all instances of TrueConf Server to versions 5.3.9, 5.4.9, or 5.5.5 immediately to resolve the authentication bypass.

Proactive Monitoring: Review server access logs for unusual administrative activity or unauthorized requests originating from unknown or external IP addresses.

Compensating Controls: Implement strict network access control lists to limit exposure of the TrueConf management interface to known, trusted internal management networks only.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

Given the confirmed active exploitation and the critical nature of the vulnerability, immediate patching is mandatory. Administrators must prioritize the deployment of the provided updates to secure the environment against ongoing threats targeting this flaw.

Deep Dive #31

Am I vulnerable, and what should I do?

Operational write-up published 2026-08-21. Detection rules are starter content — validate before deploying.

CVE-2026-72529 is a missing authentication for critical function flaw (CWE-306) in TrueConf Server, an on-premises videoconferencing and unified communications platform. An unauthenticated attacker with network access to TCP/4307 can invoke an undocumented function and execute an arbitrary script. NVD rates it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-306. CISA added it to the Known Exploited Vulnerabilities catalog on August 20, 2026, with a remediation date of August 23, three days later, which is an unusually compressed window.

Two facts shape how this one should be handled, and neither is visible in the severity score.

The first is timing. TrueConf shipped the fix on June 18, 2026, roughly two months before the CVE ID was published and the KEV listing appeared. A server patched promptly in June is already covered. A server patched after July may have been running vulnerable through a period of documented in-the-wild exploitation, and applying the update now does not evict an attacker who is already resident. Compromise assessment belongs alongside the upgrade, not after it.

The second is that this CVE is half a chain. On its own it yields script execution inside TrueConf's isolated scripting environment. Paired with CVE-2026-72530 (CWE-94, code injection), which breaks out of that sandbox, it becomes pre-authentication remote code execution as NT AUTHORITY\SYSTEM. Both flaws were found by Vyacheslav Kopeytsev of Kaspersky ICS-CERT, affect identical version ranges, are reached through the same port, and were fixed in the same builds. Treat them as one unit.

Am I vulnerable?

Exposure is the product of two things: a version below the June fix, and TCP/4307 reachable from somewhere it should not be.

Affected versions

Product	Vulnerable range	Fixed in
TrueConf Server 5.5.x	Before 5.5.5	5.5.5 (released 2026-06-18)
TrueConf Server 5.4.x	Before 5.4.9	5.4.9 (released 2026-06-18)
TrueConf Server 5.3.x	Before 5.3.9	5.3.9 (released 2026-06-18)
TrueConf Server 5.0 through 5.2.10 and earlier	All versions	No in-branch fix. Vendor directs operators to technical support or an account manager to migrate to a supported branch

Windows and Linux builds are both affected. The updates are free for commercial and free editions alike, and TrueConf states that re-registration is not required when upgrading within a branch.

Diagnostic commands

All read-only.

Windows, installed version:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -like '*TrueConf*' } |
  Select-Object DisplayName, DisplayVersion, InstallDate

A DisplayVersion below the fixed build for its branch is vulnerable. Configuration under HKLM:\SOFTWARE\TrueConf\Server confirms the product is installed.

Linux, installed version:

dpkg -l | grep -i trueconf
rpm -qa 2>/dev/null | grep -i trueconf
systemctl status trueconf trueconf-web trueconf-manager --no-pager

Configuration lives under /opt/trueconf/server/etc/.

Exposure of the vulnerable port:
```
ss -lntp | grep 4307             # Linux
netstat -ano | findstr :4307     # Windows
nc -zv -w5 <server> 4307         # reachability only, from an untrusted network
```
A LISTEN on 0.0.0.0:4307 is normal, because 4307 is open by default. The finding is a successful connection from outside your client subnets. That is the precondition the reported campaign relied on.

Read "vulnerable" as version-based: any unpatched build is affected whether or not the port is currently internet-facing, because internal reachability is sufficient for an attacker already inside the network.

Vulnerability

CWE-306 describes the shape precisely. A function that performs a security-relevant action is reachable without an authentication check. Kaspersky ICS-CERT, which coordinated disclosure as KLCERT-26-057, deliberately withheld the function name and the exploitation mechanics, so no public detail exists on which call is exposed or how it is reached, and none is asserted here.

What is documented is the entry point and the boundary. TCP/4307 carries TrueConf's proprietary media and signaling protocol for audio, video, and chat file transfer. It is not a management port that happens to be exposed, it is the channel every client uses, and TrueConf's own hardening documentation instructs administrators to leave 4307 and 443 open when third-party protocols are unused. The scripting capability reached through it runs inside an isolated environment, which is what confines CVE-2026-72529 on its own to sandboxed execution and gives the paired CVE-2026-72530 (vendor-rated CVSS 9.0, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, scope-changed and higher attack complexity) something to break out of.

One scoring caveat is worth stating. FIRST currently publishes an EPSS probability of 0.28% for this CVE, placing it in the 21st percentile, for a vulnerability with confirmed exploitation by a named actor and a KEV entry. EPSS is a model of observed opportunistic scanning and it lags on newly published IDs, particularly where exploitation is targeted rather than mass-scanned. A low EPSS reading here is a property of the model's inputs, not evidence of low risk, and should not be used to deprioritize a KEV-listed item.

Threat model

Who would exploit this: Reaching a TrueConf Server means finding an on-premises conferencing host with TCP/4307 exposed, and the payoff, SYSTEM on a trusted internal communications server, rewards operators who plan follow-on activity rather than smash-and-grab actors. Kaspersky ICS-CERT documented exactly that shape. Because the flaw is unauthenticated, network-reachable, low-complexity, and highly automatable against a default-open port, broader opportunistic reuse is a reasonable expectation now that the CVE is public and KEV-listed.

What they're after:

Foothold and privilege escalation to NT AUTHORITY\SYSTEM on the server
Supply-chain delivery to downstream users by replacing the client installer the server distributes
Persistence via a web shell in the TrueConf web root, registry run keys, and Windows services
Credential access and lateral movement, including LSASS dumping, TrueConf database credentials, and SSH reverse tunnels
Espionage against the user directory, chat and conference data, and stored meeting recordings
Data exfiltration through attacker-controlled cloud storage used as command and control

Attack chain: An attacker scans for internet-reachable TrueConf Server instances on TCP/4307 and invokes the unauthenticated function to run a script on the server. That script executes inside the restricted sandbox, so the operator chains CVE-2026-72530 to break out and execute code on the host as SYSTEM. In the reported campaign the operators then planted a web shell in the TrueConf web files, harvested infrastructure and database credentials, and replaced the legitimate Windows client installer hosted on the server with an unsigned trojanized build. Users who accepted the resulting update prompt installed the backdoor through the product's normal update workflow, with no social engineering involved.

Blast radius: SYSTEM on a TrueConf Server exposes the communications estate it fronts: the user directory, chat archives, conference metadata, stored recordings, the service credentials in its database, and whatever LDAP or Active Directory bind account performs directory sync, which is frequently privileged enough to enumerate or pivot into the domain. Because the server also distributes client software, a single compromised host becomes an internal distribution point reaching employee workstations and external meeting participants. Reported follow-on activity included LSASS credential dumping, reverse SSH tunnels for sustained access, and exfiltration through a cloud storage account, so file shares, backup infrastructure, and cloud tenants sharing those credentials fall in scope.

Named operators: Kaspersky attributes the observed intrusions to Head Mare, delivering the PhantomCore RAT and the PhantomGraph backdoor against Russian instrumentation, electronics, transport, energy, IT, and software organizations, per Kaspersky ICS-CERT and Securelist. BleepingComputer notes a scope point the headlines blur: TrueConf the vendor was not breached, customer-operated servers were.

Mitigation

Patch

Upgrade to 5.3.9, 5.4.9, or 5.5.5 depending on your branch. All three shipped June 18, 2026, and cover both CVE-2026-72529 and CVE-2026-72530. Installations on 5.2.10 and earlier have no in-branch fix and require a vendor-assisted migration to a supported branch. Take a backup and read the vendor upgrade guide first.

Patching is necessary but not sufficient. Because the fix predates the KEV listing by two months, any server updated after July 2026 should be treated as possibly compromised while it was exposed. The upgrade does not remove a planted web shell, an installed service, or stolen credentials.

Configuration mitigation

TrueConf publishes no supported workaround, and the snippets below are compensating controls rather than vendor guidance. Read the caveat before applying them: 4307/TCP is the product's primary media and signaling channel, so blocking it outright disconnects every client. The goal is removing internet exposure while preserving access from known client networks.

Scope inbound 4307/TCP to trusted subnets on Windows. Verify your client ranges first; this disconnects any client outside the listed scope.

# Inspect the existing TrueConf firewall rules before changing anything
Get-NetFirewallRule -Direction Inbound | Where-Object DisplayName -like '*TrueConf*' |
  Get-NetFirewallPortFilter | Where-Object LocalPort -eq 4307

New-NetFirewallRule -DisplayName 'TrueConf 4307 - trusted subnets only' `
  -Direction Inbound -Protocol TCP -LocalPort 4307 -Action Allow `
  -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Profile Any

New-NetFirewallRule -DisplayName 'TrueConf 4307 - deny all other' `
  -Direction Inbound -Protocol TCP -LocalPort 4307 -Action Block -Profile Any

Scope inbound 4307/TCP on TrueConf Server for Linux using nftables.

# Read-only: show what currently reaches 4307/TCP
sudo nft list ruleset | grep -A3 4307

sudo nft add rule inet filter input tcp dport 4307 ip saddr { 10.0.0.0/8, 192.168.0.0/16 } accept
sudo nft add rule inet filter input tcp dport 4307 drop

Changing the listening port from its default under Control Panel > Network > Network Settings is obscurity only. It does not restore the missing authentication check.

Compensating controls

Verify client installer integrity. The trojanized builds lacked valid digital signatures, which makes Authenticode verification a reliable discriminator. Check C:\Program Files\TrueConf Server\ClientInstFiles\ against the vendor download and against your last approved upgrade date.
Extend that check to endpoints you did not serve. Organizations that never ran TrueConf Server can still be affected, because employees who joined a partner's compromised server may have pulled an infected client from it. Any TrueConf Client installed from a self-hosted server between June and August 2026 warrants signature verification.
Treat the LDAP or AD bind account as exposed on any server that was unpatched during the exposure window, and rotate it along with TrueConf database credentials.
Ship TrueConf logs off-host before triage. The operators deleted event-log records relating to the exploit, so local logs are not a trustworthy record of their own tampering.
Segment the server. A conferencing appliance rarely needs outbound internet access, arbitrary SSH egress, or broad reach into file shares and backup infrastructure. Constraining those paths limits what the documented follow-on activity can accomplish.

Detection (starter rules, validate before deploying)

These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.

Set expectations first. The exploit rides TrueConf's proprietary binary protocol on TCP/4307, not HTTP, so there is no web-log signature for the exploitation attempt itself. Everything below detects post-exploitation activity.

Network and log signals

Inbound TCP/4307 from outside the known client population: cloud and VPS ranges, the DMZ, or internal hosts with no TrueConf client installed. Short 4307 sessions that never develop into a media stream are worth triage. Kaspersky-reported infrastructure includes 81.177.32[.]12, 194.87.239[.]71, 194.87.93[.]153, 38.244.205[.]244, and 31.59.102[.]61.
An unsigned or unexpectedly modified installer at C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe. A genuine installer is always signed, which makes this the highest-signal single check.
New or modified .php files in the web root: C:\Program Files\TrueConf Server\httpconf\site\public\js\ (Linux: /opt/trueconf/server/httpconf/site/public/js/). The reported web shell overwrote locale.php, a static localization string table that should change only during a vendor upgrade. Executable PHP in a JavaScript asset directory is a finding on its own.
Service installation (System event ID 7045, Security 4697) creating SysExcSvc or SysReadSvc, with image paths under C:\Windows\System32\inetsrv\. That directory belongs to IIS, so its use on a TrueConf host is anomalous. The services were installed via a Base64-encoded PowerShell command, so flag EncodedCommand execution on this server too.
COM hijack persistence: creation of HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 pointing at a non-Microsoft DLL. On participant endpoints, look for %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll, a payload side-loaded under a legitimate-looking CRT name.
Gaps or out-of-sequence timestamps in TrueConf's own logs: C:\TrueConf\Stdout.log, C:\TrueConf\svc_logs\, C:\TrueConf\web_logs\ (Linux: /opt/trueconf/server/var/log/vcs/ and .../webmanager/). Missing entries around a suspected intrusion window are themselves an indicator.
Outbound traffic a conferencing appliance should never generate: connections to consumer cloud storage used for C2 (OneDrive, graph.microsoft.com), GitHub raw endpoints, and outbound SSH reverse tunnels. Pair with process access to LSASS and anomalous reads of the TrueConf database.

Compromise triage commands

Read-only. Any hit indicates compromise rather than mere exposure; absence of all of them does not prove cleanliness.

# Web shell hunt in the TrueConf web root
Get-ChildItem -Path 'C:\TrueConf','C:\Program Files\TrueConf Server' -Recurse -Filter '*.php' -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -like '*\public\js\*' } |
  Select-Object FullName, Length, LastWriteTime

# PhantomGraph services and PhantomCore COM-hijack persistence
Get-Service -Name 'SysExcSvc','SysReadSvc' -ErrorAction SilentlyContinue
Get-ChildItem 'C:\Windows\System32\inetsrv\' -Include 'SysExcSvc.dll','SysReadSvc.dll','graphi-refresh.dat' -Recurse -ErrorAction SilentlyContinue
Get-Item 'HKCU:\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32' -ErrorAction SilentlyContinue

# Installer signature check, more reliable than a hash comparison
Get-AuthenticodeSignature 'C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe'

Kaspersky published MD5 4d27b4eb1c5dbb3d8160f29b8119523e for the locale.php web shell (detected as Backdoor.PHP.WebShell.abi). We could not independently verify that hash, and a hash match will not survive a payload rewrite, so prefer the modification-time and signature checks above as your primary discriminators.

YARA

rule CVE_2026_72529_TrueConf_WebShell_Starter
{
    meta:
        description = "AI-generated STARTER rule. Detects a PHP web shell planted in the TrueConf Server web root after exploitation of CVE-2026-72529 (unauthenticated script execution via TCP/4307) chained with CVE-2026-72530 (sandbox breakout). Modelled on the Head Mare / PhantomCore intrusions reported by Kaspersky ICS-CERT."
        author = "CVE Brief (AI-generated starter rule, validate before deploying)"
        date = "2026-08-21"
        cve = "CVE-2026-72529"
        reference1 = "https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/"
        reference2 = "https://securelist.com/head-mare-targets-trueconf-server-with-phantomcore/120988/"
        scan_scope_windows = "C:\\Program Files\\TrueConf Server\\httpconf\\site\\public\\"
        scan_scope_linux = "/opt/trueconf/server/httpconf/site/public/"
        note = "Known planted path is httpconf\\site\\public\\js\\locale.php. Any .php under a js/ asset directory is itself suspicious."

    strings:
        $php = "<?php"

        /* Command and response tokens reported for the Head Mare web shell */
        $tok1 = "X-Redirect-Bit" ascii nocase
        $tok2 = "UPL ok::" ascii
        $tok3 = "DWN fail nexs" ascii

        /* Generic PHP command-execution primitives */
        $exec1 = "shell_exec" ascii nocase
        $exec2 = "passthru" ascii nocase
        $exec3 = "proc_open" ascii nocase
        $exec4 = "popen" ascii nocase
        $exec5 = "system(" ascii nocase
        $exec6 = "pcntl_exec" ascii nocase

        /* Attacker-controlled request input reaching those primitives */
        $src1 = "$_POST" ascii
        $src2 = "$_GET" ascii
        $src3 = "$_REQUEST" ascii
        $src4 = "$_SERVER['HTTP_" ascii
        $src5 = "getallheaders" ascii nocase
        $src6 = "php://input" ascii nocase
        $src7 = "$_FILES" ascii

        /* Obfuscation commonly wrapped around the payload */
        $obf1 = "base64_decode" ascii nocase
        $obf2 = "gzinflate" ascii nocase
        $obf3 = "str_rot13" ascii nocase
        $obf4 = "eval(" ascii nocase
        $obf5 = "assert(" ascii nocase
        $obf6 = "create_function" ascii nocase

        /* A stock TrueConf locale file is a plain string table */
        $benign1 = "return array(" ascii nocase

    condition:
        $php
        and filesize < 500KB
        and (
            2 of ($tok*)
            or ( 1 of ($exec*) and 1 of ($src*) and 1 of ($obf*) )
            or ( 2 of ($exec*) and 2 of ($src*) and not $benign1 )
        )
}

Sigma

title: Suspicious Child Process or Service Payload From TrueConf Server (CVE-2026-72529 Exploitation)
id: 7f3c9a41-2e6b-4d58-b0af-9c1d84e5f2a7
status: experimental
description: |
    AI-generated STARTER rule. Detects command interpreters, script hosts and discovery
    LOLBins spawned by a TrueConf Server process, and the trojanized-installer execution
    chain seen in the Head Mare / PhantomCore intrusions. CVE-2026-72529 (CWE-306) lets an
    unauthenticated attacker reach an undocumented function on TCP/4307 and run a script
    inside the TrueConf sandbox; CVE-2026-72530 (CWE-94) breaks out of that sandbox to run
    code on the host as NT AUTHORITY\SYSTEM. A conferencing server has no legitimate reason
    to spawn cmd.exe or powershell.exe during normal operation, so any hit deserves triage.
references:
    - https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/
    - https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/
    - https://securelist.com/head-mare-targets-trueconf-server-with-phantomcore/120988/
author: CVE Brief (AI-generated starter rule, validate before deploying)
date: 2026-08-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.persistence
    - attack.t1505.003
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    parent_is_trueconf_server:
        ParentImage|contains:
            - '\TrueConf Server\'
            - '\TrueConf\Server\'
    child_is_shell_or_lolbin:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
            - '\curl.exe'
            - '\php.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\whoami.exe'
            - '\systeminfo.exe'
            - '\sc.exe'
            - '\reg.exe'
            - '\ssh.exe'
    trojanized_installer_batch_chain:
        ParentImage|endswith:
            - '\trueconf_windows_update.exe'
            - '\trueconf_windows_client_x64.exe'
        CommandLine|contains|all:
            - 'cmd'
            - '.bat'
    persistence_service_install:
        CommandLine|contains:
            - 'SysExcSvc'
            - 'SysReadSvc'
            - '\System32\inetsrv\SysExcSvc.dll'
            - '\System32\inetsrv\SysReadSvc.dll'
            - '{0340F119-A598-4ed9-B0AC-6F6A12D3E755}'
    condition: (parent_is_trueconf_server and child_is_shell_or_lolbin) or trojanized_installer_batch_chain or persistence_service_install
fields:
    - ParentImage
    - ParentCommandLine
    - Image
    - CommandLine
    - User
    - IntegrityLevel
falsepositives:
    - TrueConf Server installation, in-place upgrade, repair or uninstall, which legitimately spawns batch files, sc.exe and registration helpers. Correlate with a change ticket and confirm the running installer is vendor-signed.
    - Administrator maintenance run from an interactive shell whose working directory is the TrueConf install path, including the vendor log-collection and backup or restore procedures.
    - Inventory, monitoring, backup or vulnerability-scanning agents that enumerate the host with whoami.exe, systeminfo.exe, sc.exe or reg.exe under a service parent process.
    - Administrator-configured LDAP, PBX or gateway integrations, and scheduled scripts, that TrueConf Server is intentionally allowed to invoke.
    - Security tooling that legitimately writes files into C:\Windows\System32\inetsrv on a host that also runs IIS, which can surface the inetsrv path strings without the malicious service names.
level: high

Rule notes

The Sigma rule fires on shell and LOLBin children of any process under the TrueConf Server install directory, because the CVE-2026-72530 sandbox breakout surfaces as OS command execution under that parent, plus the trojanized-updater batch chain and the service persistence strings. The YARA rule hunts the PHP web shell, combining the campaign-specific tokens reported by Kaspersky with generic input-to-exec heuristics so it survives a payload rewrite. Sourced from vendor and Kaspersky reporting: the port, the install and web-root paths, ClientInstFiles, the log directories, the service and DLL names, and the CLSID. Deliberately generic because they could not be sourced: the TrueConf service and executable names (the rule matches the install-directory path in ParentImage rather than inventing an .exe name), and the undocumented function invoked on 4307, so there is no protocol-level signature here.

CVE Brief Security Intelligence

CVE-2026-72529

Executive summary

Vulnerability

Business impact

Remediation

Exploitation status

Analyst recommendation

More TrueConf CVEs