CVE-2026-72529KEV · OVERDUECWE-306

TrueConf Server Missing Authentication for Critical Function Vulnerability

Critical · published August 19, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 73.4th percentile for exploit probability.

63
days past CISA
deadline
CVSS v3.1
9.8
EPSS
1%
Percentile
73.4
In the wild
Confirmed
What it is

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01464 · 73.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-19T21:21Z
KEV added
2026-08-20 · due 2026-08-23
Affected products (6)
ProductVersionsFixed in
trueconf/trueconf_server< 5.3.9.100135.3.9.10013
trueconf/trueconf_server< 5.3.9.100155.3.9.10015
trueconf/trueconf_server≥ 5.4.0.12689, < 5.4.9.100725.4.9.10072
trueconf/trueconf_server≥ 5.4.0.12700, < 5.4.9.100195.4.9.10019
trueconf/trueconf_server≥ 5.5.0.13826, < 5.5.5.100105.5.5.10010
trueconf/trueconf_server≥ 5.5.0.13828, < 5.5.5.100095.5.5.10009
References (3)
https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/ · [email protected]https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 AUG 16:55Z
    A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
    cvelistv5