TrueConf Server is on-premises video conferencing — the kind an organisation runs itself rather than buying as a service, often for exactly the reason that it keeps meetings off somebody else's cloud.

Two critical flaws affect every version since 2022:

  • CVE-2026-72529 — calling an undocumented function to execute arbitrary scripts
  • CVE-2026-72530 — escaping the isolated environment to execute scripts on the host

Both are reachable by a remote attacker with access to the server on port 4307/TCP. Both were patched in June 2026, in versions 5.3.9, 5.4.9 and 5.5.5.

Two deadlines in one listing

CISA added both to its Known Exploited Vulnerabilities catalogue on 20 August 2026 — and gave federal agencies 3 days for CVE-2026-72529 and 2 weeks for CVE-2026-72530.

That split is unusual and it is informative. KEV deadlines are normally uniform, so two different clocks in one listing is CISA saying something about the two flaws that the CVSS scores do not: one is being used harder, or more easily, than the other. If you are triaging with limited hands, the 3-day one is the answer.

What the attackers do with it

Kaspersky attributes the exploitation to Head Mare, a hacktivist group, deploying malware called PhantomCore.

The sequence, per Kaspersky: replace one of the server's own files with a web shell, then use that position to gather infrastructure information and reach databases.

Then the part that changes the shape of the incident — the attackers distribute malicious client installers.

A conferencing server hands software to the endpoints that connect to it. Compromise the server and you inherit that channel, and the installer arrives from the internal address staff have been told to trust. That is the same mechanic as the car head units taking malware through their own update path: the attacker does not defeat a trust decision, they inherit one already made.

The bit that should sting

The patch has existed since June. The exploitation is happening in August.

This is not a zero-day story. It is a two-month story, on a product bought specifically by organisations who wanted to control their own infrastructure — and controlling it includes patching it. The same gap produced 8,500 SharePoint servers still exposed after ransomware started on theirs.

What to do

  • Patch to 5.3.9, 5.4.9 or 5.5.5. Available since June.
  • Do not stop at patching. A web shell placed before the patch survives it. Compare the server's files against a known-good install.
  • Rotate credentials for anything the server could reach, especially the databases Kaspersky says were accessed.
  • Check what clients downloaded and when. If installers were served during the exposure window, the endpoints are in scope, not just the server.
  • Restrict port 4307/TCP to the networks that need it. A conferencing server does not need to accept that port from the internet.

What is not established

  • How many servers were compromised. No count has been published.
  • Who Head Mare works for. Described as hacktivist; attribution beyond that is not established here.
  • Whether malicious installers reached any confirmed victim. The capability is documented; outcomes are not.
  • Why the two deadlines differ. CISA does not explain its reasoning publicly.