CVE-2026-72529
TrueConf Server Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-72529 is a critical missing authentication vulnerability in TrueConf Server, the on-premises video conferencing platform. A remote unauthorized attacker with network access via port 4307/TCP can execute an arbitrary script by calling an undocumented function — no credentials are required, because the function performs no authentication at all. TrueConf Server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5 and earlier are affected. Because it provides unauthenticated script execution, this vulnerability is the natural entry point that pairs with the sandbox escape CVE-2026-72530 on the same port. CVE-2026-72529 carries a CVSS score of 9.8, is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Kaspersky has documented exploitation of TrueConf Server by the Head Mare group deploying PhantomCore malware.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trueconf | trueconf server | < 5.3.9.10013; < 5.3.9.10015; >= 5.4.0.12689, < 5.4.9.10072; >= 5.4.0.12700, < 5.4.9.10019; >= 5.5.0.13826, < 5.5.5.10010; >= 5.5.0.13828, < 5.5.5.10009 |
References
- https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/(Third Party Advisory)
- https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing authentication for a critical function is the complete absence of an identity check in front of functionality that requires one — not weak authentication, but none. In CVE-2026-72529 TrueConf Server exposes an undocumented function on port 4307/TCP that executes an arbitrary script, and any unauthorized remote caller who knows to invoke it is served, because the function relies on being undocumented rather than on any access control.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-72529 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction — reaching port 4307/TCP is the entire precondition, which is why it scores 9.8 while the related sandbox escape, requiring specific technique, scores lower. Confidentiality, integrity and availability impacts are all High: arbitrary script execution on a conferencing server exposes meeting data, recordings, user directories and server configuration, allows the attacker to alter that state, and permits the service to be disabled. The scope is UNCHANGED because execution remains within the server's scripting environment; combining this flaw with CVE-2026-72530, which breaks out of that isolated environment onto the host, converts the pair into full host compromise. That chain is precisely what an attacker wants: this vulnerability provides trivially easy unauthenticated access to script execution, and the companion flaw removes the containment. The EPSS score of roughly 1.6% (74th percentile) reflects targeted rather than mass exploitation, but the KEV listing and attributed threat-actor activity are the signals that matter.
Exploit Maturity
CVE-2026-72529 has confirmed exploitation attributed to an organised threat actor. CISA has listed it in the Known Exploited Vulnerabilities catalog with a remediation deadline of 23 August 2026 that has already passed, and Kaspersky's Securelist has published research documenting the Head Mare group targeting TrueConf Server with PhantomCore malware, tagged as exploit material; Kaspersky ICS-CERT issued a corresponding advisory. The EPSS score of about 1.6% (74th percentile) is moderate because EPSS reflects broad internet-wide scanning, which understates a campaign run by a specific group against selected victims. The chaining potential is the decisive factor: this vulnerability delivers unauthenticated script execution with minimal effort, and CVE-2026-72530 escapes the sandbox onto the host, so defenders should assume that any instance exposed on port 4307 has been probed and treat the pair as a single emergency.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with TrueConf's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 23 August 2026 has passed.
- Upgrade TrueConf Server to a fixed build. Fixed versions include 5.3.9.10013 and 5.3.9.10015, 5.4.9.10072 and 5.4.9.10019, and 5.5.5.10010 and 5.5.5.10009 depending on the build line deployed; the Kaspersky ICS-CERT advisory on missing authentication for a critical function in TrueConf Server documents the issue and affected builds.
- Block port 4307/TCP from untrusted networks immediately. This is the single most effective containment: exploitation requires network access to that port, so restricting it at the firewall to trusted management ranges or blocking it from the internet closes both this vulnerability and the companion sandbox escape CVE-2026-72530 while patching is scheduled.
- Assume compromise and hunt for PhantomCore. Because a known threat group has been observed exploiting TrueConf Server, treat any instance that was reachable on port 4307 while unpatched as an incident: inspect the host for unfamiliar executables, scheduled tasks, services and outbound connections, review server logs for connections to port 4307 from unexpected sources, and use the indicators in Kaspersky's Securelist analysis of Head Mare targeting TrueConf Server with PhantomCore.
- Rotate credentials and harden long term. Reset TrueConf administrative passwords and rotate directory, database and integration credentials the server holds, then place conferencing infrastructure behind a VPN or restricted VLAN; as the general defence for this weakness class, identify every function that executes code or consumes significant resources and require authentication for each explicitly — never rely on a function being undocumented as a substitute for an access control.
Technical Details
CVE-2026-72529 is a missing authentication flaw for a critical function (CWE-306) in TrueConf Server. The server listens on port 4307/TCP and exposes an undocumented function there that executes an arbitrary script. No authentication is performed before that function runs, so a remote unauthorized attacker who reaches the port and invokes the function obtains script execution directly — the only protection was obscurity, and obscurity fails as soon as the function's existence is known. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H records a network-reachable, low-complexity attack with no privileges and no user interaction, and complete impact on confidentiality, integrity and availability at unchanged scope. The scope remains unchanged because the executed script runs inside the server's isolated scripting environment; CVE-2026-72530, disclosed at the same time and reachable through the same port, provides the breakout from that isolation to the host operating system, so the two vulnerabilities are complementary halves of one attack path.
Frequently Asked Questions
Is CVE-2026-72529 being actively exploited?
Yes, by a named threat actor. CISA added CVE-2026-72529 to its Known Exploited Vulnerabilities catalog with a remediation due date of 23 August 2026 that has passed, and Kaspersky has documented the Head Mare group exploiting TrueConf Server and deploying PhantomCore malware. The moderate EPSS score reflects targeted rather than opportunistic exploitation.
What products are affected by CVE-2026-72529?
TrueConf Server is affected in versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5 and earlier. Fixed builds include 5.3.9.10013 and 5.3.9.10015, 5.4.9.10072 and 5.4.9.10019, and 5.5.5.10010 and 5.5.5.10009 depending on the deployed build line, and exposure depends on port 4307/TCP being reachable.
How do I fix CVE-2026-72529?
Upgrade TrueConf Server to the fixed build for your release line and immediately block port 4307/TCP from untrusted networks — that single control also mitigates the related sandbox escape CVE-2026-72530. Then hunt the host for PhantomCore indicators published by Kaspersky and rotate administrative, directory and integration credentials.
How severe is CVE-2026-72529?
CVE-2026-72529 is Critical with a CVSS 3.1 base score of 9.8. It is unauthenticated, network-exploitable with low complexity and no user interaction, and grants arbitrary script execution on a conferencing server with full confidentiality, integrity and availability impact; chained with CVE-2026-72530 it leads to code execution on the host itself, and confirmed exploitation by an organised group past an expired KEV deadline makes it an emergency priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.