CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability

What it is

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

What to do

Treat this as urgent. Identify every affected system, starting with anything internet-facing, and apply the vendor fix or mitigation within days. If you cannot patch quickly, isolate or disable the affected service and watch for signs of compromise.

Priority

Act now: Patch or mitigate internet-facing systems within days.

Severity (CVSS)

9.3 critical

CISA assessment (SSVC)

actively exploited; attackers can automate it at scale; total control of the affected system

Exploit probability (EPSS, 30 days)

1.5%, higher than 72% of all CVEs

Added to CISA KEV

20 August 2026

CISA fix-by date

23 August 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-306

References

• NIST NVD entry
• CISA KEV entry
• ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authenticat
• securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.