Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
Analysis Summary
# Vulnerability: Critical RCE and Sandbox Escape in TrueConf Server
## CVE Details
- **CVE ID:** CVE-2026-72529
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-306 (Missing Authentication for Critical Function)
- **CVE ID:** CVE-2026-72530
- **CVSS Score:** 9.0 (Critical)
- **CWE:** CWE-94 (Improper Control of Generation of Code / Code Injection)
## Affected Systems
- **Products:** TrueConf Server (Self-hosted communications platform)
- **Versions:** All versions prior to the security patches released in mid-2026.
- **Configurations:** Systems exposing port 4307/TCP to the network.
## Vulnerability Description
**CVE-2026-72529:** A missing authentication flaw where the server fails to verify the identity of a user when accessing a specific undocumented critical function. By connecting via 4307/TCP, a remote attacker can bypass authentication to execute arbitrary scripts.
**CVE-2026-72530:** A code injection vulnerability resulting from improper management of code generation. This flaw allows an attacker who has already achieved code execution within the isolated TrueConf environment to escape the sandbox and execute commands directly on the underlying host operating system.
## Exploitation
- **Status:** Exploited in the wild (Actively exploited by "Head Mare" hacktivist group and others).
- **Complexity:** Low (CVE-2026-72529) / High (CVE-2026-72530).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Full access to server data and communications).
- **Integrity:** High (Ability to modify client installers and deploy backdoors).
- **Availability:** High (Total system compromise).
## Remediation
### Patches
- TrueConf has released security updates to address these vulnerabilities. Administrators should update to the latest available version of TrueConf Server immediately.
- Federal agencies are mandated by CISA to apply these patches by September 3, 2026.
### Workarounds
- Restrict access to port **4307/TCP** to trusted internal IP addresses only.
- Ensure the TrueConf Server is not exposed directly to the public internet without a VPN or strict ACLs.
## Detection
- **Indicators of compromise:**
- Presence of unauthorized scripts in the TrueConf directory.
- Unusual outbound network traffic from the TrueConf Server host.
- Unexpected modifications to client installer files (trojanization).
- **Detection methods and tools:**
- Monitor logs for connections to port 4307/TCP from unrecognized or external IP addresses.
- File integrity monitoring (FIM) for the TrueConf installation directory.
## References
- Vendor Advisory: hxxps[://]trueconf[.]com/blog/news/security-fixes-updates-and-advisories#CVE-2026-72529_Missing_Authentication
- CISA KEV Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- BleepingComputer Report: hxxps[://]www[.]bleepingcomputer[.]com/news/security/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws/