TrueConf server RCE exploited in the wild (CVE-2026-72530)

Actively exploited in the wild - CVE-2026-72530 is a critical sandbox escape in TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier that grants unauthenticated remote code execution on the host system. Patched in version 5.6.0 - update immediately.

Overview

CVE-2026-72530 is a critical vulnerability in TrueConf server, a video conferencing and collaboration platform. The flaw resides in the server’s isolated script execution environment, reachable by any remote attacker on port 4307/TCP without authentication. By sending a specially crafted script to this port, an attacker can break out of the sandbox and execute arbitrary code with the privileges of the TrueConf server process on the underlying operating system.

The vulnerability carries a CVSS score of 9.5 (Critical), reflecting the combination of network attack vector, no privileges required, and no user interaction needed. While the attack complexity is rated high - which typically means exploitation requires specific conditions or timing - the fact that this vulnerability is confirmed in CISA’s Known Exploited Vulnerabilities (KEV) catalog and actively exploited in the wild indicates that attackers have already developed reliable exploit methods.

Impact

Successful exploitation gives an attacker full control over the host system. This means they can:

• Read, modify, or delete sensitive data stored on the server
• Install persistent backdoors or malware
• Move laterally to other systems on the network
• Disrupt video conferencing services for all users
• Potentially access recordings, meeting metadata, or user credentials stored on the server

The EPSS score of 0.3% suggests exploitation attempts remain relatively rare, but the confirmed in-the-wild activity makes this a priority patching target.

Remediation

TrueConf has released version 5.6.0 which addresses this vulnerability. Affected organizations should:

1. Update to TrueConf server 5.6.0 or later immediately
2. Until patched, restrict network access to port 4307/TCP using firewall rules or network segmentation
3. Monitor for suspicious activity on port 4307/TCP in network logs
4. Review the vendor advisory and CISA KEV listing for additional guidance

Security Insight

This vulnerability follows a troubling pattern of collaboration and communication platforms becoming prime targets for initial access. The fact that TrueConf - a product often deployed at the network edge to enable external video calls - contains a remotely exploitable sandbox escape highlights how edge services remain the weakest link in many enterprise networks. Organizations should treat any internet-facing service that processes user-supplied data as a high-value target and prioritize rapid patching, even for products not traditionally considered critical infrastructure.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs