The addition of CVE-2026-72529 and CVE-2026-72530 to CISA's Known Exploited Vulnerabilities Catalog deserves particular attention because the two vulnerabilities affect TrueConf Server and can form a highly effective remote compromise chain. CVE-2026-72529 is a critical missing-authentication vulnerability rated 9.8 under CVSS v3.1. An unauthenticated remote attacker with network access to TCP port 4307 can invoke an undocumented critical function and cause TrueConf Server to execute an arbitrary script. CVE-2026-72530, rated 9.0 under CVSS v3.1, affects the application's isolated execution environment and allows specially crafted code to break out of that isolation and execute arbitrary commands on the underlying Windows or Linux host. Neither vulnerability requires user interaction, and both are now associated with real-world exploitation rather than theoretical laboratory attacks. 

The relationship between the vulnerabilities is more important than either CVSS score viewed in isolation. CVE-2026-72529 gives the attacker the ability to invoke functionality without authenticating, but application-level script execution might otherwise remain constrained by TrueConf's isolated environment. CVE-2026-72530 attacks exactly that second boundary. Once the isolation mechanism is bypassed, attacker-controlled code can reach the operating system itself. This illustrates why defenders should evaluate vulnerability chains rather than treating every CVE as an independent line in a vulnerability scanner. Attackers are perfectly happy to combine two imperfect capabilities if together they produce complete compromise.

CVE-2026-72529 is particularly concerning because the vulnerable service listens on TCP port 4307 and does not properly authenticate callers before exposing a critical function. TrueConf describes the weakness as missing authentication, while the CVE information states that a remote unauthorized attacker can call the undocumented function and execute an arbitrary script. The published CVSS vector reflects network reachability, low attack complexity, no required privileges, no user interaction, and high impact to confidentiality, integrity, and availability.

The term "undocumented function" should not provide any comfort. Security should never depend on attackers being unaware that a function exists. Once the application accepts network requests, every reachable operation needs explicit authorization appropriate to its sensitivity. An undocumented administrative or execution interface exposed to unauthenticated network clients is still an exposed interface. Obscurity may delay discovery, but it is not a security boundary.

CVE-2026-72530 demonstrates the next problem. TrueConf uses an isolated environment intended to constrain code execution, but Kaspersky found that a specially crafted script could escape that environment and execute arbitrary code on the host. The vulnerability is classified as code injection or sandbox escape and has high confidentiality, integrity, and availability impact. Its attack complexity is higher than CVE-2026-72529 because exploitation requires satisfying additional conditions, but that distinction becomes substantially less reassuring once an attacker already controls script execution through the first vulnerability.

This is the same architectural principle used in modern browsers. A browser vulnerability may provide code execution inside a sandbox, while a separate vulnerability escapes the sandbox and reaches the operating system. Neither stage necessarily provides complete compromise alone. Together they can. TrueConf's vulnerabilities demonstrate that this attack model is not limited to browsers. Any application that executes untrusted or semi-trusted code inside an isolation boundary must assume attackers will eventually look for a second weakness that escapes it.

The exploitation evidence makes these vulnerabilities considerably more urgent. Kaspersky says the Head Mare APT group has exploited vulnerabilities in unpatched TrueConf Server environments as part of attacks that ultimately distribute the PhantomCore and PhantomGraph backdoors. The attackers also used compromised TrueConf infrastructure to deliver malicious software installers to conference participants.

That last step substantially changes the potential blast radius. The TrueConf server does not have to remain merely the victim. Once compromised, it can potentially become part of the attacker’s delivery infrastructure.

This is particularly dangerous for collaboration platforms because users inherently trust software, invitations, installers, and communication originating from the organization’s own conferencing infrastructure. If attackers compromise the server from which legitimate meeting software or resources are delivered, malicious payloads can inherit some of that trust. The intrusion therefore begins to resemble a supply-chain attack: compromise the infrastructure people already trust rather than trying to convince every user independently to visit an obviously suspicious site.

Kaspersky’s reporting on Head Mare shows exactly why attackers value this position. The group used the compromised TrueConf environment to deliver PhantomCore and PhantomGraph malware to targets interacting with the conferencing system. The attacker is effectively moving one level upstream. Instead of spear-phishing every endpoint individually, compromising a collaboration server creates the possibility of reaching multiple participants through a legitimate organizational channel.

This should change how organizations classify video-conferencing infrastructure. Self-hosted collaboration servers are sometimes treated as ordinary communication applications, sitting somewhere between email and productivity software in asset inventories. In reality, they can be externally reachable servers handling authentication, user directories, software distribution, meeting metadata, audio/video communications, and integrations with internal infrastructure. That makes them high-value attack surfaces.

Exposure of TCP port 4307 deserves immediate review. Organizations should determine whether the service genuinely needs to be reachable from the public internet or broadly across internal networks. Where external exposure is unnecessary, firewall policy should restrict access to explicitly authorized networks or hosts. Network segmentation will not correct either vulnerability, but reducing the population of systems capable of reaching the vulnerable service materially reduces attack opportunity.

However, organizations should not rely on blocking the port as a substitute for patching. TrueConf has published corrected versions and recommends immediate updates. Affected installations include versions earlier than 5.3 and vulnerable releases across the 5.3.x, 5.4.x, and 5.5.x branches. TrueConf lists corrected builds including 5.3.9.10013 or later on Windows and 5.3.9.10015 or later on Linux, 5.4.9.10018 or later on Windows and 5.4.9.10019 or later on Linux, and 5.5.5.10010 or later on Windows and 5.5.5.10009 or later on Linux.

The exact build number matters because administrators may otherwise conclude that simply running "5.5.5" or "5.4.9" proves remediation. TrueConf's current security advisory provides platform-specific fixed builds, so organizations should validate the full installed version rather than relying only on the marketing release number. This is the sort of tedious detail that separates actual vulnerability management from a spreadsheet claiming everything is green.

TrueConf had already urged customers in June 2026 to move to the latest 5.3.9, 5.4.9, or 5.5.5 security releases and warned that failing to install security updates would reduce protection against attacks over the public internet. The later exploitation findings demonstrate why security updates for internet-facing collaboration infrastructure cannot be left indefinitely behind ordinary application testing queues.

Because exploitation is already confirmed, organizations that operated vulnerable TrueConf Servers need to do more than install the latest build. They should perform retrospective compromise assessment covering the period during which the server remained vulnerable. Kaspersky's vulnerability guidance explicitly recommends scanning for indicators of compromise and changing potentially compromised account passwords if malicious activity is identified.

The incident-response question should therefore be divided into two parts.

First: is the server still vulnerable?

Second: was it compromised while it was vulnerable?

Installing the update answers only the first.

Forensic investigation should examine TrueConf application logs, operating-system authentication records, process creation, scheduled tasks, services, recently modified binaries and scripts, and unexpected outbound connections. Because the second vulnerability allows host-level execution, defenders should assume attackers may establish persistence that no longer depends on TrueConf after the initial exploitation succeeds.

Any unexpected script interpreter or shell spawned from TrueConf-related processes deserves scrutiny. On Windows, that might include PowerShell, `cmd.exe`, scripting hosts, or unusual DLL execution. On Linux, administrators should investigate unexpected shell processes, cron entries, systemd services, SSH keys, and recently created executables associated with the TrueConf service account or surrounding application environment.

Outbound network activity is equally important. Collaboration servers often have relatively predictable communication patterns. A TrueConf server suddenly communicating with unfamiliar external infrastructure, downloading executables, or establishing persistent connections deserves immediate investigation. Egress controls can make this behavior easier to detect and can sometimes interrupt the post-exploitation chain even after the original vulnerability succeeds.

Organizations should also review whether compromised infrastructure could have delivered malicious installers or other content to users. Kaspersky's Head Mare investigation makes this especially important because the threat actor used malicious TrueConf installers to deploy PhantomCore and PhantomGraph. If server compromise is confirmed, endpoint hunting needs to extend beyond the server to systems belonging to users who downloaded software or interacted with the affected infrastructure during the compromise period.

This creates a potentially much larger incident than the vulnerable server itself. A clean rebuild of TrueConf does not automatically remove malware installed on participant endpoints. 

Security teams should therefore correlate server events with endpoint telemetry to determine which systems received downloads or executed software during the relevant timeframe. Where suspicious installers were delivered, hashes, file paths, process trees, persistence mechanisms, and outbound communication should be investigated.

Credential exposure also needs consideration. Once arbitrary operating-system code execution is achieved, any secrets accessible from the TrueConf host may become compromised. These may include service-account credentials, database passwords, API tokens, TLS private keys, integration credentials, and administrative passwords depending on deployment configuration.

Rotating credentials should therefore extend beyond the password used to log into the TrueConf web interface. The relevant question is which secrets the compromised operating-system account could read.

If a private key used to authenticate the legitimate conferencing service is stolen, rebuilding the server while continuing to trust the same key may leave another security problem behind. Where compromise is confirmed, certificates and keys should be evaluated for replacement alongside ordinary credentials.

Centralized external logging becomes particularly important because CVE-2026-72530 may provide arbitrary host-level code execution. An attacker with sufficient operating-system control may alter or delete local logs. TrueConf, operating-system, authentication, and firewall events should therefore be forwarded to independent infrastructure so historical evidence survives compromise of the conferencing server itself.

The two flaws also demonstrate why sandboxing should be treated as one layer rather than the final security boundary. Isolation technologies remain extremely valuable. CVE-2026-72529 would potentially be substantially less damaging if execution could never escape the restricted environment. But defenders need to assume that sandbox vulnerabilities will occasionally appear.

The correct architecture therefore places additional controls beyond the sandbox: operating-system least privilege, restricted filesystem access, network segmentation, egress restrictions, separate service identities, and monitoring of the sandbox host.

If a sandbox escape occurs, the attacker should encounter another boundary rather than receiving unrestricted access to everything the server can reach.

The KEV status is ultimately what changes the operational decision. CVE-2026-72529 has a CVSS v3.1 score of 9.8 and CVE-2026-72530 scores 9.0, but the more valuable piece of information is that exploitation is active. CISA's vulnerability enrichment characterizes the technical impact of CVE-2026-72530 as total.

Organizations should therefore prioritize these flaws ahead of unexploited vulnerabilities that may carry similar numerical severity. Attackers have already performed the risk assessment for us. They found the vulnerabilities useful enough to deploy. 

The broader lesson from CVE-2026-72529 and CVE-2026-72530 is that modern collaboration systems have become part of the enterprise trust infrastructure. Employees trust the server. They trust meeting invitations originating from it. They may trust software distributed through it. And administrators frequently expose at least part of it to external networks because collaboration requires external connectivity. That makes the server an attractive target. CVE-2026-72529 allows an attacker to cross the authentication boundary. CVE-2026-72530 allows them to cross the isolation boundary. And the Head Mare campaign demonstrates what happens next: the compromised collaboration infrastructure can potentially become a mechanism for compromising the people using it. That is why these vulnerabilities should not be treated simply as two TrueConf patches. They represent an attack chain from unauthenticated network access, through application execution, through sandbox escape, and potentially onward to the endpoints that trust the compromised platform.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 10 Sep 2026.