VulnerabilityBleeping Computer
9.8 — CRITICAL
CISA orders feds to patch actively exploited TrueConf Server flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
The U.S. government has ordered federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform, CVE-2026-72529 and CVE-2026-72530, which allow attackers to execute arbitrary scripts and code on unpatched servers.
⚙️Technical Details
CVEs
CVE-2026-72529CVE-2026-72530Affected Systems: TrueConf Server
Affected Systems
TrueConf Server
Attack Vectors
NETWORK:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
U.S. federal agencies and organizations using TrueConf Server
🛡️Recommended Actions
1Patch CVE-2026-72529 and CVE-2026-72530 in all TrueConf Server installations within two weeks of this advisory.
2Implement strict access controls for TrueConf Server, including authentication and authorization mechanisms.
3Monitor network traffic for suspicious activity related to port 4307/TCP
📦Affected Products
Trueconf Trueconf ServerTrueconf Trueconf
🔐NVD Verified DataVERIFIED
CVE-2026-72529 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-306
Affected Products (CPE)
Trueconf Trueconf Server
CVE-2026-72530 ↗CVSS 9 — CRITICAL
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-94
Affected Products (CPE)
Trueconf Trueconf Server
CVE-2026-3502 ↗CVSS 7.8 — HIGH
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:LWeaknesses
CWE-494
Affected Products (CPE)
Trueconf Trueconf
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.