CVE-2026-72530
TrueConf Server Code Injection Vulnerability
Description
CVE-2026-72530 is a critical code injection vulnerability in TrueConf Server, the on-premises video conferencing platform. A remote unauthorized attacker with network access via port 4307/TCP can use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system, escaping the sandbox that is supposed to contain scripting. TrueConf Server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5 and earlier are affected. The sandbox escape carries a CVSS score of 9.0 with a changed scope, it is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Kaspersky has documented its use by the Head Mare threat group deploying PhantomCore malware — making this a vulnerability with confirmed targeted exploitation rather than merely theoretical risk.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trueconf | trueconf server | < 5.3.9.10013; < 5.3.9.10015; >= 5.4.0.12689, < 5.4.9.10072; >= 5.4.0.12700, < 5.4.9.10019; >= 5.5.0.13826, < 5.5.5.10010; >= 5.5.0.13828, < 5.5.5.10009 |
References
- https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/(Third Party Advisory)
- https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when software constructs all or part of a code segment from externally influenced input without neutralising elements that alter the syntax or behaviour of the intended code. In CVE-2026-72530 an attacker supplies a specially crafted script to TrueConf Server through port 4307/TCP, and the server's scripting facility executes it in a way that escapes its intended isolation, so the injected code runs against the host operating system rather than staying confined.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2026-72530 is remotely exploitable over the network with no authentication and no user interaction, though attack complexity is High — the attacker must craft a script that specifically defeats the isolation mechanism, which is more demanding than simply submitting input. The scope is CHANGED, and that is the heart of this vulnerability: the code escapes the isolated environment and executes on the host system, so the impact lands outside the component that failed. Confidentiality, integrity and availability impacts are all High, giving the attacker the host's data, the ability to modify system state and install persistence, and the option to disable the conferencing service entirely. A video conferencing server is a particularly sensitive host to lose, since it mediates confidential meetings and typically sits inside the internal network with directory integration. The EPSS score of roughly 1.8% (78th percentile) understates the risk considerably, because the documented exploitation is targeted rather than opportunistic — Kaspersky attributes attacks on TrueConf Server to the Head Mare group deploying PhantomCore.
Exploit Maturity
CVE-2026-72530 has confirmed, attributed exploitation by an organised threat actor. Kaspersky's Securelist has published research documenting the Head Mare group targeting TrueConf Server with PhantomCore malware, tagged as exploit material, and Kaspersky ICS-CERT issued a dedicated advisory on the isolated-environment breakout. CISA has confirmed active exploitation through its KEV listing, with a deadline of 3 September 2026 that has passed. The EPSS score of about 1.8% (78th percentile) is moderate and should be read in context: EPSS models broad internet-wide exploitation, and an attack conducted by a specific group against selected victims produces a lower statistical signal than its severity warrants. The chaining potential with CVE-2026-72529 is the key operational detail — an attacker uses the missing authentication flaw to get a script executing and this vulnerability to escape isolation onto the host.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with TrueConf's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 3 September 2026 has passed.
- Upgrade TrueConf Server to a fixed build. Fixed versions include 5.3.9.10013 and 5.3.9.10015, 5.4.9.10072 and 5.4.9.10019, and 5.5.5.10010 and 5.5.5.10009 depending on the build line in use; consult the Kaspersky ICS-CERT advisory on the TrueConf Server isolated-environment breakout and TrueConf's own release information to identify the exact target build.
- Block port 4307/TCP from untrusted networks right now. Exploitation requires network access to that specific port; restricting it at the firewall to trusted management ranges, or blocking it from the internet entirely, is an effective and immediately applicable containment — and it also mitigates the companion vulnerability CVE-2026-72529, which reaches the same port without authentication.
- Assume compromise and hunt for PhantomCore. Because a named threat group has been observed exploiting TrueConf Server, treat any exposed unpatched instance as an incident: inspect the host for unfamiliar executables, scheduled tasks, services and outbound connections, review conferencing server logs for connections to port 4307 from unexpected sources, and consult Kaspersky's Securelist analysis of Head Mare targeting TrueConf Server with PhantomCore for indicators of compromise.
- Rotate credentials and harden long term. Change TrueConf administrative passwords and rotate directory, database and integration credentials held by the server, then reduce exposure by placing conferencing infrastructure behind a VPN or restricted VLAN; as the general defence for code injection, never allow externally supplied content to be evaluated as code, and where scripting must be supported, ensure the sandbox is a genuine security boundary that is tested against escape rather than a convenience layer.
Technical Details
CVE-2026-72530 is a code injection flaw (CWE-94) in TrueConf Server that results in a sandbox escape. The server exposes functionality on port 4307/TCP that accepts and executes scripts inside what is intended to be an isolated environment. A remote unauthorized attacker can supply a specially crafted script that breaks out of that isolation and executes arbitrary code on the host system — meaning the isolation mechanism itself, rather than any missing input filter, is the control that fails. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H encodes this precisely: network-reachable without privileges or user interaction, High attack complexity because defeating an isolation boundary requires specific technique rather than a generic payload, a changed scope because execution moves from the sandbox to the host, and full impact on confidentiality, integrity and availability. The vulnerability is closely related to CVE-2026-72529, a missing authentication flaw on the same port that lets an unauthenticated attacker invoke an undocumented function to execute a script — the two together form a natural chain from unauthenticated script execution to full host compromise.
Frequently Asked Questions
Is CVE-2026-72530 being actively exploited?
Yes, by a named threat actor. CISA added CVE-2026-72530 to its Known Exploited Vulnerabilities catalog with a remediation due date of 3 September 2026 that has passed, and Kaspersky has published research documenting the Head Mare group exploiting TrueConf Server and deploying PhantomCore malware. Its moderate EPSS score reflects targeted rather than opportunistic exploitation.
What products are affected by CVE-2026-72530?
TrueConf Server is affected in versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5 and earlier. Fixed builds include 5.3.9.10013 and 5.3.9.10015, 5.4.9.10072 and 5.4.9.10019, and 5.5.5.10010 and 5.5.5.10009, depending on the build line deployed.
How do I fix CVE-2026-72530?
Upgrade TrueConf Server to the fixed build for your release line and immediately block port 4307/TCP from untrusted networks, which also mitigates the related unauthenticated flaw CVE-2026-72529. Because a known threat group has exploited this vulnerability, also hunt the host for PhantomCore indicators and rotate administrative and directory credentials.
How severe is CVE-2026-72530?
CVE-2026-72530 is Critical with a CVSS 3.1 base score of 9.0. It is unauthenticated and network-exploitable with no user interaction, and crosses a security scope boundary by escaping the isolated environment to execute arbitrary code on the host with full confidentiality, integrity and availability impact; attack complexity is High because the sandbox escape requires specific technique, but confirmed exploitation by an organised threat group makes it an emergency priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.