All vulnerabilities
CVE-2026-72529

TrueConf Server Missing Authentication for Critical Function Vulnerability

TrueConf Server
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationExploited in the wildAdded to KEV 20 Aug 2026CISA KEV
Exploit odds (EPSS)1.46%Chance of exploitation activity in the next 30 days, higher than 73% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.3Also 5.3.9, 5.4.9 and 1 moreCVE List
Federal deadline23 Aug 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 19 Aug 2026, 16:55 UTCPublishedCVE List
  2. 20 Aug 2026Added to CISA KEVCISA KEV

Description

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

Text from CVE List

Affected versions 4

  • TrueConf Serveraffected: * before 5.3CVE List
  • TrueConf Serveraffected: 5.3 before 5.3.9CVE List
  • TrueConf Serveraffected: 5.4 before 5.4.9CVE List
  • TrueConf Serveraffected: 5.5 before 5.5.5CVE List

References 5