CISA added two actively exploited flaws in the TrueConf Server video-conferencing platform to its KEV catalog. CVE-2026-72529 (CVSS 9.3) is a missing-authentication bug: an undocumented function on port 4307/TCP lets an unauthenticated attacker run an arbitrary script with no credentials. CVE-2026-72530 (CVSS 9.0) is a code-injection / sandbox-escape bug: an attacker who has reached the server breaks out of its isolated environment and runs code directly on the host, taking full control.
Per Kaspersky, the Head Mare hacktivist group has chained the two since at least July 2026 — and the payoff is a supply-chain attack: it replaces the TrueConf client installer with a malicious version, so victims download a trojanized client from a legitimate-but-compromised server. Patches shipped back in June in versions 5.3.9, 5.4.9, and 5.5.5.
Why this is doubly dangerous
A conferencing server usually sits on the perimeter and integrates with corporate identities. The combo “unauth script → sandbox escape → host RCE → tampered client installer” turns one server into a malware-distribution point for the whole company and its contacts. This is why “just RCE” undersells it — it’s an installer-supply-chain compromise.
What to do
- Update TrueConf Server to 5.3.9 / 5.4.9 / 5.5.5 or later immediately.
- Block port
4307/TCPfrom the internet and restrict server access to trusted IPs. - Verify client-installer integrity and hashes; if the server was internet-facing, assume installers may have been swapped and check endpoints.
To find exposed services and paths to the domain, use external and internal network penetration testing; if you suspect a tampered installer, an assumed-breach assessment maps the damage. Get in touch.
Sources: CISA KEV; Kaspersky reporting on Head Mare; BleepingComputer, SecurityWeek, SecurityAffairs; TrueConf advisory.