CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
The US cybersecurity agency CISA on Thursday warned federal agencies that threat actors have been exploiting two vulnerabilities in TrueConf.
A secure on-premises video conferencing platform, TrueConf relies on Scalable Video Coding (SVC) to connect client applications through a dedicated corporate server.
All TrueConf Server versions since 2022 contain two critical-severity bugs tracked as CVE-2026-72529 and CVE-2026-72530 that allow attackers to execute arbitrary code.
The two vulnerabilities can be exploited by remote attackers with access to the TrueConf server via port 4307/TCP. CVE-2026-72529 allows the attacker to call an undocumented function and execute arbitrary scripts, while CVE-2026-72530 enables them to escape the isolated environment and execute scripts on the host system.
The exploited vulnerabilities were addressed in June 2026, in TrueConf Server versions 5.3.9, 5.4.9 and 5.5.5.
On Thursday, CISA addedboth to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch the former within three days and...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
