All vulnerabilities
CVE-2026-72530

TrueConf Server Code Injection Vulnerability

TrueConf Server
Open in ThreatlineRecord JSON
CVSS
9.5Critical
ExploitationExploited in the wildAdded to KEV 20 Aug 2026CISA KEV
Exploit odds (EPSS)1.69%Chance of exploitation activity in the next 30 days, higher than 76% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.3Also 5.3.9, 5.4.9 and 1 moreCVE List
Federal deadline3 Sep 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 19 Aug 2026, 16:56 UTCPublishedCVE List
  2. 20 Aug 2026Added to CISA KEVCISA KEV

Description

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Text from CVE List

Affected versions 4

  • TrueConf Serveraffected: * before 5.3CVE List
  • TrueConf Serveraffected: 5.3 before 5.3.9CVE List
  • TrueConf Serveraffected: 5.4 before 5.4.9CVE List
  • TrueConf Serveraffected: 5.5 before 5.5.5CVE List

References 5