CVE-2026-72530: TrueConf Server sandbox escape / code injection to host code execution
Exploited in the wild Critical 9.5 EPSS 1.7%
TrueConf Server (Windows and Linux) lets an attacker who reaches port 4307/TCP and gets code running in the server's isolated script environment escape it with a crafted script and execute arbitrary commands on the host OS (CVSS 9.0); it chains with CVE-2026-72529. TrueConf fixed both in Server 5.3.9, 5.4.9 and 5.5.5 (Linux builds 5.3.9.10015, 5.4.9.10019, 5.5.5.10009 or later), and Kaspersky ICS CERT links exploitation to the Head Mare APT group delivering PhantomCore malware. CISA added CVE-2026-72529 and CVE-2026-72530 to the Known Exploited Vulnerabilities catalog on 2026-08-20.
- CVE-2026-72530CVE identifier
- 9.5CVSS 4.0 base score (critical)
- 2026-08-20added to CISA's exploited list (US federal deadline 2026-09-03)
- 1.7%EPSS: chance of exploitation in the next 30 days (higher than 77% of CVEs)
- 2026-08-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart the affected service (or reboot for kernel and library updates) so the fix is actually in use.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- TrueConf Server before 5.3.9 (all versions before 5.3 included)
- TrueConf Server 5.4.x before 5.4.9
- TrueConf Server 5.5.x before 5.5.5
Fixed in:
- TrueConf Server 5.5.5 (Linux build 5.5.5.10009+, Windows 5.5.5.10010+)
- TrueConf Server 5.4.9 (Linux build 5.4.9.10019+, Windows 5.4.9.10018+)
- TrueConf Server 5.3.9 (Linux build 5.3.9.10015+, Windows 5.3.9.10013+)
If you cannot patch yet
- After updating, run a full antivirus scan and check for the indicators in Kaspersky's threat alert on Head Mare exploiting TrueConf to deliver PhantomCore; if any are found, change passwords of all potentially affected accounts (Kaspersky ICS CERT).
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530
Related vulnerabilities
Sources
- CVE record CVE-2026-72530
- TrueConf: Security fixes, updates and advisories
- Kaspersky ICS CERT advisory
- CVE-2026-72530 on CVE.org
- CVE-2026-72530 on NVD
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.