As reported by SecurityAffairs, CISA has added two critical TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are actively exploiting these flaws in the wild. This is not a theoretical risk — KEV inclusion means CISA has credible evidence of real-world exploitation.
Why This Matters
TrueConf Server is purpose-built for organizations that want on-premises control over their unified communications — government agencies, defense contractors, critical infrastructure operators, and enterprises with strict data sovereignty requirements. These are exactly the environments where a server compromise creates the highest blast radius: lateral movement into segmented networks, access to sensitive communications metadata, and potential persistence in environments assumed to be air-gapped or tightly controlled.
The attack surface is remarkably low-friction. Both vulnerabilities are reachable on TCP port 4307 without authentication. An attacker who can reach that port — whether through direct internet exposure, VPN access, or post-breach lateral movement — can chain CVE-2026-72529 (script execution via undocumented function) with CVE-2026-72530 (sandbox escape) to achieve full host compromise. The combination of missing authentication and code injection on the same network-exposed service is a textbook initial access vector.
Vulnerability Details
| CVE | CVSS | Type | Affected Versions | Exploited |
|---|---|---|---|---|
| CVE-2026-72529 | 9.3 (Critical) | Missing Authentication / RCE via undocumented function | TrueConf Server ≤ 5.3.9, ≤ 5.4.9, ≤ 5.5.5 | Yes |
| CVE-2026-72530 | 9.5 (Critical) | Code Injection / Sandbox Escape | TrueConf Server ≤ 5.3.9, ≤ 5.4.9, ≤ 5.5.5 | Yes |
Attack vector: Unauthenticated, remote — TCP port 4307
Discoverer: Vyacheslav Kopeytsev, Kaspersky ICS CERT
Patch status: Organizations should consult the TrueConf vendor advisory for fixed versions. Given KEV inclusion, patching is urgent.
Who Is Most Exposed
The presence of an undocumented function reachable without authentication is a red flag for defenders: it indicates the attack surface may not be fully mapped in vendor documentation, making network-level controls the most reliable interim mitigation.
Shield53 Recommendations — Immediate Actions
- Identify all TrueConf Server instances across the estate. Check asset inventories, but also scan for TCP 4307 listeners — undocumented or forgotten deployments are common in on-prem UC environments.
- Restrict network access to port 4307 immediately. Limit exposure to only the management VLAN or trusted administrator subnets. If the service must be internet-facing, place it behind a VPN or zero-trust gateway — there is no safe reason for unauthenticated internet exposure.
- Patch to the latest fixed version per the TrueConf vendor advisory. FCEB agencies must meet the BOD 22-01 remediation deadline; private organizations should treat this as a 72-hour priority.
- Hunt for compromise signs: Review logs for unexpected script execution, anomalous outbound connections from the TrueConf host, and new scheduled tasks or services. If the server was exposed, assume compromise and perform full incident response rather than patch-and-move-on.
- Segment TrueConf servers from critical infrastructure networks. These systems handle external communication flows and should not share flat network space with OT or crown-jewel systems.
- Validate sandbox assumptions: CVE-2026-72530 demonstrates that sandboxing in security products can become a false comfort. Document where sandbox escapes invalidate your trust boundaries.
The broader lesson here is that on-premises does not automatically mean secure. Self-hosted collaboration platforms inherit the same exposure risks as any internet-adjacent service, and their position inside trusted networks makes them attractive stepping stones. KEV inclusion for a UC platform should prompt every organization running on-prem video infrastructure — not just TrueConf — to audit their exposure posture.
