CVE-2026-72529: TrueConf Server — Missing Authentication for Critical Function

Background

TrueConf Server is an on-premises video conferencing platform, widely deployed by organizations that need to keep meeting infrastructure inside their own network rather than relying on a cloud provider. That deployment model makes it common in government, industrial, and regulated environments, particularly in Russia and CIS countries where TrueConf has a strong install base.

CVE-2026-72529 is a missing-authentication vulnerability in TrueConf Server, tracked by Kaspersky ICS-CERT as KLCERT-26-057. It allows a remote, unauthenticated attacker with network access to the server’s port 4307/TCP to invoke an undocumented function and execute an arbitrary script on the server, no credentials, no user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on August 20, 2026, with a remediation deadline of August 23, three days later, the tightest turnaround of the two TrueConf entries added that day.

This CVE is closely related to CVE-2026-72530, a code injection vulnerability in the same product also disclosed by Kaspersky and added to KEV on the same date. As detailed below, security researchers have documented these two flaws being chained together in a real attack campaign.

Technical Mechanism

CVE-2026-72529 is classified under CWE-306 (Missing Authentication for Critical Function). The root cause, per Kaspersky’s advisory, is an undocumented function exposed by the TrueConf Server service listening on port 4307/TCP that does not enforce authentication before executing attacker-supplied input. A remote attacker who can reach that port, which is open by default, can call the function directly and have the server execute an arbitrary script, without ever authenticating.

NVD’s CVSS 3.1 vector for this CVE is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8): network-exploitable, low attack complexity, no privileges or user interaction required, and full confidentiality, integrity, and availability impact. NVD also lists a CVSS 4.0 score of 9.3.

Because the executed script runs inside TrueConf Server’s isolated execution environment (the sandbox), CVE-2026-72529 on its own gives an attacker script execution within that constrained context. The companion vulnerability, CVE-2026-72530, is what lets an attacker break out of that sandbox and reach the underlying host OS. Kaspersky’s incident report on the Head Mare campaign (see below) confirms the two are exploited in sequence: CVE-2026-72529 first, to get unauthenticated script execution, then CVE-2026-72530 to escape the isolated environment and run commands as NT AUTHORITY\SYSTEM.

Real-World Exploitation Evidence

CISA’s KEV catalog lists known ransomware campaign use for CVE-2026-72529 as “Unknown.” KEV addition itself signals that CISA has evidence of exploitation, not necessarily large-scale or ransomware-driven activity, and the confirmed exploitation here fits that distinction.

Kaspersky ICS-CERT published a report on August 12, 2026, documenting a campaign by Head Mare, a threat actor Kaspersky tracks (previously classified as hacktivist-motivated, now assessed with APT-level tradecraft) targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development sectors. According to Kaspersky and corroborating reporting from BleepingComputer and The Hacker News, Head Mare connected to exposed TrueConf servers on port 4307/TCP, exploited the missing-authentication flaw (KLCERT-26-057, this CVE) to execute a script inside the sandbox, then used the sandbox-escape flaw (KLCERT-26-058 / CVE-2026-72530) to gain SYSTEM-level code execution on the host. From there, attackers replaced a legitimate server file (locale.php under the TrueConf web root) with a web shell and used that access to trojanize the TrueConf client installer distributed to meeting participants, delivering a backdoor Kaspersky calls PhantomCore, along with a separate two-module backdoor called PhantomGraph that used Microsoft OneDrive as its command-and-control channel.

Kaspersky states the vendor shipped fixes for both flaws on June 18, 2026, and that it detected active exploitation in July 2026, meaning attacks were occurring against servers that had not yet applied the already-available patch. The public advisories were not published until August 7, 2026, and CISA’s KEV addition followed on August 20. Note this is a distinct incident from an earlier, unrelated TrueConf Client update-verification flaw (CVE-2026-3502) that CISA added to KEV in April 2026; the two should not be conflated.

Impact Assessment

CVE-2026-72529 lets a remote, unauthenticated attacker with network access to port 4307/TCP execute an arbitrary script on the server with no credentials and no user interaction, reflected in NVD’s CVSS 3.1 base score of 9.8. On its own, the executed script runs inside TrueConf Server’s isolated execution environment, so the immediate blast radius is bounded by that sandbox. In practice that bound does not hold: the companion flaw, CVE-2026-72530, lets an attacker chain out of the sandbox and reach the host as NT AUTHORITY\SYSTEM, and Kaspersky’s incident report confirms this exact chain occurred against real Russian organizations.

The confirmed campaign shows the practical consequences: attackers used the initial unauthenticated access this flaw provides to eventually plant a web shell by replacing locale.php in the TrueConf web root, then trojanized the TrueConf client installer distributed to meeting participants, delivering the PhantomCore backdoor and a separate OneDrive-based backdoor called PhantomGraph. Because TrueConf Server is widely deployed in government, industrial, and regulated environments, particularly across Russia and CIS countries, successful exploitation can cascade from a single exposed server into supply-chain-style compromise of every meeting participant who downloaded the trojanized client.

Given that Kaspersky detected active exploitation in July 2026, a full month before public advisories and the CISA KEV addition, any organization running an affected, internet-reachable TrueConf Server during that window should treat the host as a potential compromise, not just a pending patch.

Affected Versions

Both Windows and Linux builds are affected. TrueConf’s own security advisory page confirms the same version ranges and lists the fix as shipped in 5.3.9, 5.4.9, and 5.5.5.

Remediation Steps

TrueConf has released fixed versions: 5.3.9, 5.4.9, and 5.5.5. Organizations running any earlier version, including anything prior to the 5.3 branch, should upgrade immediately.

1. Patch first. Update TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 (or later), whichever branch applies to your deployment.
2. Federal deadline. CISA’s BOD 26-04 sets a remediation due date of August 23, 2026 for this CVE, notably tighter than the September 3, 2026 deadline for the companion sandbox-escape CVE (CVE-2026-72530), reflecting the lower bar to exploitation (no authentication needed at all).
3. Network exposure. Until patched, restrict inbound access to TCP/4307 to trusted management networks only; this port should not be reachable from the general internet or untrusted internal segments.
4. Assume compromise if exposed unpatched between June and August 2026. Given confirmed exploitation during that window, treat any internet-facing or loosely segmented TrueConf Server that was unpatched during that period as potentially compromised and investigate rather than patch-and-move-on.
5. Check for the specific IOC reported by Kaspersky: an unexpected or modified locale.php file under the TrueConf Server web root (.../httpconf/site/public/js/locale.php on Windows installs) is a strong indicator of the web shell used in the observed campaign.

Detection Guidance

• Network monitoring: Alert on inbound connections to TCP/4307 from unexpected source IPs, particularly from outside your management network or the internet.
• File integrity monitoring: Watch the TrueConf Server web root, especially locale.php and other files under httpconf/site/public/js/, for unauthorized modification. This was the specific persistence mechanism observed in the Head Mare campaign.
• Process and privilege monitoring: TrueConf Server processes spawning unexpected child processes, or gaining/using NT AUTHORITY\SYSTEM privileges outside of normal service behavior, warrants investigation.
• Client installer integrity: If your TrueConf Server distributes client installers to meeting participants, verify installer file hashes against vendor-published values; trojanized installers were the delivery mechanism for the PhantomCore backdoor in the observed campaign.
• Log review: Check for gaps or deletions in TrueConf Server event logs. The observed campaign included log deletion to cover tracks after web shell deployment.
• Endpoint indicators: Kaspersky’s report identifies PhantomCore delivered as a DLL named api-ms-win-crt-time-l1-1-0-2.dll under %LOCALAPPDATA%\TrueConf\Client\, and PhantomGraph persisting via two services/DLLs named SysExcSvc and SysReadSvc with outbound connections to Microsoft OneDrive for command-and-control.

Timeline

References

• Kaspersky ICS-CERT — KLCERT-26-057: TrueConf Server. Missing authentication for critical function
• Kaspersky ICS-CERT — Head Mare exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware
• TrueConf — Security fixes, updates, and advisories
• NVD — CVE-2026-72529
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — Hackers breach TrueConf to trojanize client installers with backdoors
• The Hacker News — Head Mare Exploits TrueConf Flaws