TrueConf server RCE exploited in the wild (CVE-2026-72529)

Actively exploited in the wild - CVE-2026-72529 is a critical remote code execution vulnerability in TrueConf server versions 5.5.5 and earlier that lets unauthenticated attackers execute arbitrary scripts via port 4307/TCP. Patched versions are available; upgrade immediately.

Overview

CVE-2026-72529 affects TrueConf server video conferencing platforms across versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and all earlier releases. The vulnerability stems from an undocumented function that remote attackers can invoke without authentication. By sending crafted network requests to port 4307/TCP, an attacker can execute arbitrary scripts on the server operating system.

The flaw carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and complete lack of required privileges or user interaction. CISA has confirmed this vulnerability is being actively exploited in the wild and has added it to the Known Exploited Vulnerabilities (KEV) catalog.

Impact

Successful exploitation grants attackers full remote code execution on the TrueConf server. This means they can:

• Run arbitrary commands with the privileges of the server process
• Steal or modify conference recordings and user credentials
• Move laterally into the internal network
• Deploy ransomware or persistent backdoors

TrueConf servers often sit at network perimeters to handle external video calls, making them a prime entry point for broader network compromise. The low EPSS score of 0.3% suggests exploitation attempts remain targeted rather than mass-scanning, but active exploitation confirms real-world attacker interest.

Remediation

TrueConf has released patched versions addressing CVE-2026-72529. Organizations running affected versions should:

1. Upgrade immediately to TrueConf server 5.3.10, 5.4.10, or 5.5.6 (or newer), depending on your version branch
2. Restrict network access to port 4307/TCP using firewall rules, allowing only trusted endpoints
3. Audit server logs for suspicious requests to port 4307, especially from unexpected IP addresses
4. Review user accounts for signs of unauthorized creation or privilege changes

If immediate patching is not possible, isolate the TrueConf server from the broader network until upgrades complete.

Security Insight

This vulnerability follows a troubling pattern of collaboration platform flaws becoming prime targets for initial access. Like the 2023 Cisco Unified Communications Manager vulnerabilities that allowed unauthenticated remote code execution on voicemail systems, TrueConf’s undocumented function exposure suggests a gap in secure development review of legacy API surfaces. Video conferencing infrastructure is particularly attractive to attackers because it sits outside typical email security controls and often holds sensitive meeting content and credentials. The active exploitation within weeks of disclosure underscores how quickly attackers weaponize flaws in internet-facing communication systems, reinforcing why network segmentation and rapid patch cycles remain critical for these deployments. For related coverage, see breach reports and security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs