CISA’s August 20, 2026 addition of CVE-2026-72529 and CVE-2026-72530 to the Known Exploited Vulnerabilities catalog deserves particular attention because the two flaws are not merely independent vulnerabilities in TrueConf Server. They can be chained together to move from unauthenticated network access to arbitrary code execution with the highest privileges on the underlying operating system. More importantly, this attack chain has already been observed in real-world attacks, where the Head Mare APT group compromised TrueConf servers, installed web shells and then turned the trusted TrueConf client distribution mechanism into a malware-delivery channel for users connecting to those servers.

TrueConf Server is an on-premises video conferencing and corporate communications platform used by enterprises, government organisations and other environments that prefer to keep communications infrastructure within their own networks. The affected releases include all TrueConf Server versions before 5.3, version 5.3.x before 5.3.9, version 5.4.x before 5.4.9 and version 5.5.x before 5.5.5. TrueConf released the corrected versions 5.3.9, 5.4.9 and 5.5.5 on June 18, 2026 and explicitly recommended immediate upgrades.

CVE-2026-72529: missing authentication for a critical function

CVE-2026-72529 is the first stage of the attack chain and is arguably the vulnerability that opens the door. It is classified as CWE-306, Missing Authentication for Critical Function, and carries a CVSS 3.1 score of 9.8. An unauthenticated remote attacker with network access to TCP port 4307 can call an undocumented TrueConf Server function and execute an arbitrary script. No valid TrueConf account is required, no previous privileges are needed and no user interaction is necessary.

Port 4307 is especially important because Kaspersky reports that it is open by default according to TrueConf documentation. This transforms what might otherwise have been a niche internal vulnerability into a significant network-facing attack surface. An attacker who can communicate with this service can submit malicious scripting content without first passing through an authentication boundary. In practical terms, the server exposes functionality powerful enough to execute scripts but does not reliably establish that the party requesting that functionality is authorised to do so.

The vulnerability demonstrates why undocumented functionality can become particularly dangerous. Administrators may carefully protect web administration interfaces, enforce MFA and restrict normal user accounts while being completely unaware that another network service exposes a powerful internal function. Attackers do not care whether an interface appears in the administrator manual. If it listens on a network port and can be reached, it becomes part of the attack surface.

However, exploitation of CVE-2026-72529 alone does not immediately provide unrestricted operating-system access. The malicious script initially executes inside an isolated TrueConf environment where potentially dangerous libraries and capabilities, including normal operating-system and file I/O functionality, are restricted. This isolation is intended to prevent scripts from escaping into the underlying Windows or Linux server. Unfortunately, that brings us directly to the second vulnerability.

CVE-2026-72530: code injection and escape from the isolated environment

CVE-2026-72530 is a code-injection vulnerability classified as CWE-94. It affects the same TrueConf Server release families and carries a CVSS 3.1 score of 9.0 and CVSS 4.0 score of 9.5. An unauthorised remote attacker able to reach TCP port 4307 can use a specially crafted script to escape TrueConf's isolated execution environment and execute arbitrary code on the host operating system. Exploitation requires no authentication or user interaction, although Kaspersky rates the attack complexity as high because several attempts may be required for reliable exploitation.

This vulnerability fundamentally defeats the assumption that running attacker-controlled code inside a sandbox makes that code safe. CVE-2026-72529 allows the attacker to place malicious scripting logic inside the isolated environment, while CVE-2026-72530 breaks the boundary preventing that script from interacting directly with the host operating system. Chained together, the two vulnerabilities convert an unauthenticated connection to a network service into operating-system command execution.

On vulnerable Windows TrueConf servers, Kaspersky observed the chain resulting in execution with NT AUTHORITY\SYSTEM privileges. That is effectively the highest standard privilege level on a Windows system. Once SYSTEM-level execution is achieved, the attacker is no longer attacking only the TrueConf application. They control the server on which TrueConf is running and can modify files, access credentials, install persistent malware, inspect databases and potentially move into other parts of the organisation.

This distinction is critical. A vulnerability in a collaboration application might initially sound like a confidentiality issue involving meeting information or user accounts. In reality, chaining CVE-2026-72529 and CVE-2026-72530 can turn the videoconferencing server into an attacker-controlled system with privileged access to the organisation's infrastructure.

The real-world exploitation makes these vulnerabilities considerably more significant. Kaspersky discovered that the Head Mare APT group was actively using the two vulnerabilities against unpatched TrueConf servers. After gaining SYSTEM-level execution, the attackers replaced a TrueConf server file with their own web shell. That web shell gave them persistent remote control even after the initial exploitation stage had finished.

The attackers then used this access to gather information about the victim's IT infrastructure and obtain privileged access to the TrueConf Server database. This illustrates another reason collaboration platforms are attractive targets. They can contain user directories, organisational relationships, conference information and credentials while also being positioned close to other internal infrastructure. Compromising such a server therefore provides both intelligence and an excellent platform for subsequent attacks.

The most concerning part of the campaign, however, is what happened next. Instead of limiting themselves to the TrueConf server, the attackers replaced the legitimate TrueConf Windows client installer stored on the compromised server with a malicious version. When users connected to that organisation's TrueConf environment and were prompted to download or update the client, they received the attacker-modified installer directly from a server they had every reason to trust.

The malicious installer still installed the legitimate TrueConf client, making the process appear normal, but it additionally deployed the PhantomCore malware. PhantomCore provided the attackers with remote command-execution capability on the victim workstation and established persistence through a Windows registry location under `HKEY_CURRENT_USER\Software\Classes\CLSID`. This converted the original server compromise into a supply-chain-style attack against everyone downloading the client from that server.

This attack path is strategically important because victims do not necessarily need to belong to the organisation operating the compromised TrueConf server. Kaspersky specifically warns that employees from other organisations may connect to a compromised contractor or partner's TrueConf server for meetings and subsequently download the infected client installer. An organisation can therefore be affected even if it does not operate TrueConf Server itself.

That fundamentally changes the risk model. A compromised conferencing server can become a malware distribution platform across organisational boundaries. Partners, customers, suppliers or government departments invited to legitimate meetings may receive malicious software through a trusted business relationship. The security boundary therefore extends beyond the company that owns the server.

The attackers also deployed another backdoor called PhantomGraph. Kaspersky found that PhantomGraph used Microsoft OneDrive as part of its command-and-control mechanism. Using legitimate cloud services for C2 is particularly troublesome because defenders cannot simply assume that communication with a well-known cloud provider is benign or block the entire service without potentially disrupting legitimate business activity.

On Linux-based TrueConf servers, Kaspersky found additional persistence mechanisms. The attackers deployed a backdoor capable of intercepting TrueConf network functions and listening for attacker commands transported through the TrueConf protocol itself. Another Linux backdoor used GitHub as a command-and-control channel. These techniques demonstrate a broader trend in modern attacks: adversaries increasingly hide malicious communication within protocols and cloud services that organisations already trust.

The combination of CVE-2026-72529 and CVE-2026-72530 therefore represents much more than conventional remote code execution. The full observed chain looks approximately like this: an attacker reaches TCP port 4307 without authentication, abuses the undocumented function through CVE-2026-72529 to execute a malicious script inside TrueConf's isolated environment, exploits CVE-2026-72530 to escape that environment and obtain host-level code execution, gains SYSTEM privileges, installs a web shell, accesses the TrueConf database, replaces legitimate client installers and ultimately distributes malware to users connecting to the compromised conferencing infrastructure.

For customers operating TrueConf Server, the immediate action is to upgrade to at least version 5.3.9, 5.4.9 or 5.5.5 depending on the deployed branch. TrueConf itself describes the June 2026 update as an important security update and warns that failing to install it reduces protection against attacks originating from the public Internet. Organisations running versions 5.2 or older should contact TrueConf because the normal update path differs for those older installations.

Because these vulnerabilities are already being exploited, however, patching alone is no longer sufficient for systems that were exposed while vulnerable. Administrators need to distinguish between closing the vulnerability and determining whether somebody already exploited it. Updating the server prevents the same entry path from being used again, but an attacker who has already installed a web shell, backdoor or replacement installer no longer needs the original vulnerability.

Organisations should therefore perform a compromise assessment on vulnerable TrueConf installations. Kaspersky recommends scanning for indicators of compromise, performing a full antivirus or EDR examination and changing passwords for potentially affected accounts where malicious activity is found. Administrators should also verify the integrity of TrueConf application files and client installers and investigate unexpected modifications occurring before the server was patched.

Particular attention should be paid to the client installer stored on the TrueConf server. Kaspersky observed attackers replacing `C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe` with a trojanised installer. Organisations should therefore compare currently hosted installers against trusted vendor distributions or known-good hashes rather than assuming that a file located inside the official TrueConf directory is legitimate.

Customers should also investigate the presence of web shells and unexpected PHP or application files. Kaspersky identified a malicious `locale.php` web shell during the observed campaign. File-integrity monitoring around TrueConf application directories can provide useful detection because attackers frequently convert temporary RCE into durable persistence by modifying files that continue accepting commands long after the vulnerability is patched.

Network controls can provide another important defensive layer. TCP port 4307 should not be exposed more broadly than operationally necessary. If external access is not required, it should be blocked at perimeter firewalls. Where communication through the port is genuinely required, access should be limited to known network ranges or appropriate trusted systems wherever architecture permits. A service being enabled by default does not mean it needs to be reachable by everybody on the Internet, although software defaults and sensible security architecture continue their long-running disagreement.

Internal segmentation is equally important. A TrueConf server should not automatically have unrestricted access to domain controllers, administrative networks, databases and unrelated server segments. If the conferencing platform is compromised, segmentation should limit the destinations an attacker can subsequently reach. Application servers should receive only the network connectivity genuinely necessary for their function.

Outbound traffic should also be monitored. The observed use of OneDrive and GitHub for command-and-control demonstrates why destination reputation alone is increasingly insufficient. Communication with legitimate cloud services may still represent malicious behaviour. Security controls need contextual visibility into which system is making the connection, how often it occurs, what volume of information is being exchanged and whether that behaviour is normal for that server.

Endpoint monitoring on TrueConf servers should look for application processes spawning command interpreters, PowerShell, shells or other utilities that are unusual for normal conferencing activity. New Windows services, suspicious DLLs, modified PHP files, unexpected scheduled tasks and connections from the server to uncommon Internet destinations should all receive investigation.

Organisations should also monitor their TrueConf database and administrative activity for unexpected privilege changes or unusual queries. Once Head Mare obtained access, the attackers reportedly used the compromised server to gain privileged database access. A legitimate TrueConf service interacting with its own database can look superficially normal, so behavioural monitoring is important. The security question is not merely whether the TrueConf process is authorised to access the database, but whether the volume and nature of that access are consistent with normal operation.

Another particularly important defensive measure is verifying software-update integrity. The Head Mare attack demonstrates how dangerous it is when users implicitly trust software simply because it is downloaded from an internal or partner server. Executables should ideally be digitally signed and signature verification should occur before installation. Security controls should flag unsigned or incorrectly signed binaries claiming to be trusted enterprise software. In the observed campaign, replacing the legitimate TrueConf client distribution transformed an otherwise trusted update workflow into the attacker's malware-delivery mechanism.

This becomes particularly relevant when combined with the separate TrueConf client vulnerability CVE-2026-3502 disclosed earlier in 2026. That flaw involved insufficient integrity verification of client updates and was exploited in the TrueChaos campaign against Southeast Asian government organisations. While CVE-2026-3502 is distinct from the two Server CVEs added by CISA on August 20, the incidents collectively demonstrate how attractive TrueConf's server-to-client trust relationship has become to attackers. Compromise the trusted infrastructure once, and the software distribution mechanism can potentially reach many endpoints.

Security teams should therefore think about these vulnerabilities as a trust-chain attack rather than just a vulnerable conferencing server. The TrueConf Server is trusted by administrators, connected users trust the TrueConf Server, and their endpoints trust the client installer supplied by that server. The attacker needs to break the chain only at one sufficiently powerful point and can then exploit the remaining trust relationships.

There is also an important lesson about sandboxing. CVE-2026-72530 demonstrates that restricted script environments should never be the only boundary separating attacker-controlled code from the underlying operating system. A sandbox is valuable, but its failure should not immediately provide SYSTEM privileges. Services processing potentially hostile scripts should run under dedicated low-privilege accounts, with filesystem restrictions, minimal credentials and limited network access. If a sandbox escape occurs, there should ideally be another security boundary behind it.

For organisations whose employees have participated in external TrueConf conferences, protection requires a slightly different approach. They should review whether employees downloaded TrueConf installers from external TrueConf servers during the relevant attack period, verify that installed TrueConf clients are legitimate and digitally signed, scan endpoints for PhantomCore and PhantomGraph indicators and investigate unusual persistence or network activity associated with TrueConf installations. Kaspersky explicitly warns that organisations without their own TrueConf Server can still be exposed through compromised servers operated by business partners.

This point makes the incident especially relevant for supply-chain risk management. Traditional vendor-risk assessments tend to concentrate on whether a supplier directly stores organisational data. The TrueConf campaign demonstrates another form of dependency risk: simply interacting with a compromised partner's communications infrastructure may be enough to deliver malware into your environment.

The broader lesson from CISA's KEV addition is that authentication, isolation and trusted software distribution need to be considered as one continuous security chain. CVE-2026-72529 breaks the authentication boundary. CVE-2026-72530 breaks the execution-isolation boundary. Once both are defeated, the attacker can compromise the server and then exploit the trust users place in that server to attack their endpoints.

This is also precisely why CISA's KEV catalog should receive greater priority than vulnerability severity scores alone. These two vulnerabilities are not hypothetical weaknesses waiting for a researcher to construct an elegant proof of concept. Attackers have already demonstrated how to combine them into a practical intrusion chain, achieve SYSTEM-level execution, establish persistence and weaponise legitimate software distribution. CISA added both vulnerabilities to KEV on August 20 specifically because there is evidence of active exploitation.

For customers, the appropriate response is therefore layered: update TrueConf Server immediately to 5.3.9, 5.4.9, 5.5.5 or later; restrict TCP 4307 to only the systems that genuinely need it; verify the integrity of server files and client installers; hunt for web shells, PhantomCore and PhantomGraph; review server and database activity; monitor outbound cloud communications; rotate credentials where compromise is suspected; and investigate endpoints that may have downloaded TrueConf software from vulnerable internal or third-party servers.

The most important security lesson from CVE-2026-72529 and CVE-2026-72530 is not simply that two critical bugs existed in a video conferencing server. It is how effectively attackers converted those vulnerabilities into a chain of trust abuse. They moved from an unauthenticated network connection, to sandboxed script execution, to a sandbox escape, to SYSTEM privileges, to persistent server compromise, and finally to malware distribution through legitimate client installers. That progression demonstrates why defending only the initial perimeter is no longer sufficient. Security architecture must assume that one control can fail and ensure that the next boundary is capable of containing what happens afterward.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72530 TrueConf Server Code Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed i

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 20 Aug 2026.