U.S. cybersecurity officials are urging fast action after CISA warned that threat actors have been exploiting two TrueConf CVEs in the organization’s on-premises video conferencing environment. The alert is aimed specifically at federal agencies, but it is highly relevant for any organization running TrueConf Server.
According to CISA, the affected software versions contain critical-severity flaws that allow remote attackers to execute arbitrary code. CISA added both issues to its Known Exploited Vulnerabilities (KEV) catalog, setting urgent remediation deadlines.
Two exploited TrueConf CVEs enable remote code execution
TrueConf is an on-premises video conferencing platform that uses Scalable Video Coding (SVC) to connect client applications through a dedicated corporate server. CISA’s warning focuses on TrueConf Server installations that have been running since 2022 and include two bugs cataloged as CVE-2026-72529 and CVE-2026-72530.
Both vulnerabilities are rated critical. CISA states that remote attackers with access to the TrueConf server can exploit them. In particular, attackers can reach the service through port 4307/TCP.
The first issue, CVE-2026-72529, can be leveraged by calling an undocumented function that results in arbitrary script execution. The second, CVE-2026-72530, enables attackers to escape an isolated environment and then execute scripts on the host system.
KEV listing sets patch timelines for federal agencies
CISA escalated the response by adding both vulnerabilities to its KEV catalog. The goal is simple: ensure federal defenders apply fixes for vulnerabilities that are known to be exploited in real-world attacks.
In this case, the remediation expectations are time-bound. Agencies were told to patch CVE-2026-72529 within three days, while CVE-2026-72530 has a two-week deadline.
Even if your organization is not bound by federal guidance, the message still applies—these are not theoretical weaknesses. They are being used in active exploitation.
What versions are fixed and what you should upgrade to
CISA notes that the exploited vulnerabilities were addressed by TrueConf in June 2026. Updated releases include TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5.
If your deployment is on an earlier release, upgrading to one of those patched versions should be your first priority. However, patching alone may not be enough if compromise has already occurred—so verification and follow-up checks matter.
How attackers may abuse the TrueConf service
While CISA did not publish detailed indicators about the exploitation it observed, earlier reporting from Kaspersky described how attackers leveraged these TrueConf CVEs as part of intrusions involving malware deployment.
Kaspersky linked exploitation to the hacktivist group Head Mare, which has been active since at least 2023. The group has targeted organizations in Russia and Belarus and has been associated with destructive behavior, including file-encrypting malware and ransom demands.
Crucially, Kaspersky’s assessment did not indicate that the group’s actions are financially motivated. Instead, the emphasis appears to be on disruption and intrusion impact.
From exploitation to web shell and credential access
In the intrusion scenarios Kaspersky investigated, attackers exploited CVE-2026-72529 and CVE-2026-72530 to compromise a TrueConf server. The attackers then replaced a file on the server with a web shell.
That web shell was later used for multiple malicious steps, including collecting information about the organization’s IT infrastructure, gaining privileged access to the TrueConf Server database, and swapping out legitimate client installers with malicious ones.
Once a manipulated installer was executed on an employee’s system, it could lead to malware installation. In the reported cases, that malware was PhantomCore, a payload associated with Head Mare activity.
Backdoors placed on Unix systems
Kaspersky also described the placement of additional backdoors on Unix-like systems running TrueConf. One backdoor used the TrueConf protocol for command-and-control (C&C) communications, while another relied on GitHub for coordination.
The presence of multiple components highlights why defenders should treat this as more than a single patching task. If the server is compromised, follow-on payloads can persist in ways that standard upgrade steps might not fully remove.
CISA’s recommended response: patch, hunt, and validate access
Alongside its KEV alert, CISA advised TrueConf server owners to take a structured approach. The response guidance emphasizes both remediation and detection.
First, update your TrueConf Server to a patched version. Next, scan your environment for indicators of compromise (IoCs) and look for malicious artifacts.
Finally, if you detect signs of intrusion, rotate credentials across all potentially affected accounts. This step is essential because database access and installer tampering can allow attackers to expand access beyond the original exploitation point.
Practical checklist for defenders running TrueConf
If you manage on-premises video conferencing infrastructure, you can reduce risk by moving quickly through these actions:
- Verify your TrueConf Server version and upgrade to 5.3.9, 5.4.9, or 5.5.5 if you are on an earlier release.
- Review exposure to port 4307/TCP and ensure only intended systems can reach the service.
- Hunt for IoCs tied to exploitation and post-exploitation activity (for example, unexpected files, web shells, and unusual installer changes).
- Inspect for malicious artifacts on the TrueConf server and on Unix-like systems where additional backdoors may appear.
- Rotate credentials if you find evidence of compromise, and confirm you have removed persistence.
By combining patching with targeted investigation, you avoid the common pitfall of assuming the update fully “cleans” an already-compromised environment.
Why the urgency matters
The reason CISA pushed this alert so quickly is straightforward: the affected TrueConf CVEs are not just vulnerabilities waiting to be found. They are already being exploited, with reports describing outcomes such as web shell deployment, privileged database access, and the distribution of malicious client installers.
In other words, even small delays can translate into significant exposure—especially if employees are likely to execute the client software packaged by the server.
Bottom line
CISA’s warning makes one point unmistakably clear: organizations using TrueConf Server should treat these TrueConf CVEs as urgent. Upgrade to the patched releases identified by TrueConf, check for signs of compromise, and rotate credentials if intrusion is confirmed. Acting now reduces the chance that exploitation will escalate into data access, persistent backdoors, and malware deployment.
Source: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-trueconf-vulnerabilities/
