CVE-2026-72530: TrueConf Server — Code Injection / Sandbox Escape

Background

TrueConf Server is an on-premises video conferencing platform used where organizations need to keep meeting infrastructure inside their own network. That deployment model has made it common in government, industrial, and regulated sectors, particularly in Russia and neighboring countries.

CVE-2026-72530 is a code injection vulnerability in TrueConf Server, tracked by Kaspersky ICS-CERT as KLCERT-26-058. It allows an attacker who has already achieved script execution inside the server’s isolated execution environment (a sandbox used to run untrusted or dynamic content) to break out of that sandbox and execute arbitrary code on the underlying host, reachable via the server’s port 4307/TCP. CISA added it to the Known Exploited Vulnerabilities catalog on August 20, 2026, with a remediation deadline of September 3, 2026.

This vulnerability is the second half of a two-stage chain. Its companion, CVE-2026-72529 (missing authentication for a critical function, also on port 4307/TCP), is what gives an unauthenticated attacker the initial script execution this flaw then escalates from. See our companion article on CVE-2026-72529 for the missing-auth half of the chain. Kaspersky’s incident reporting confirms the two have already been exploited together in a real campaign, detailed below.

Technical Mechanism

CVE-2026-72530 is classified under CWE-94 (Improper Control of Generation of Code / Code Injection). Kaspersky’s advisory describes the flaw as allowing an attacker who can reach TrueConf Server on port 4307/TCP to use “a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.” TrueConf’s own advisory characterizes it as “improper management of code generation” that lets an attacker who has already achieved code execution inside the isolated environment escape the sandbox and execute arbitrary commands on the underlying OS.

NVD’s CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (base score 9.0): network-exploitable, high attack complexity, no privileges or user interaction required, scope changed (the sandbox escape crosses a security boundary), with full confidentiality, integrity, and availability impact. NVD also lists a CVSS 4.0 score of 9.5. The “high attack complexity” rating reflects that, on its own, this vulnerability requires the attacker to already have code execution inside the sandbox, a precondition. That precondition is trivially satisfied by chaining it with CVE-2026-72529, which gives an unauthenticated attacker exactly that starting point over the same port.

Kaspersky’s incident report on the observed exploitation confirms this exact chain in practice: attackers first exploited the missing-authentication flaw to run a script inside the isolated environment, then used this code injection flaw to escape it and execute code with NT AUTHORITY\SYSTEM privileges on the Windows host.

Real-World Exploitation Evidence

CISA’s KEV catalog lists known ransomware campaign use for CVE-2026-72530 as “Unknown.” As with its companion CVE, KEV addition reflects confirmed evidence of exploitation rather than a claim of ransomware activity or mass-scale attacks.

Kaspersky ICS-CERT published a report on August 12, 2026, attributing exploitation of this exact vulnerability chain to Head Mare, a threat actor Kaspersky has tracked since 2023 (previously assessed as hacktivist-motivated, now reported with more sophisticated tradecraft) targeting Russian organizations in instrumentation, electronics, transportation, energy, IT, and software development. Corroborating reporting from BleepingComputer and The Hacker News describes the same chain: connection to an exposed TrueConf server on 4307/TCP, exploitation of the missing-auth flaw for initial script execution, then this sandbox-escape flaw to obtain SYSTEM-level command execution. Post-exploitation, attackers replaced a legitimate server-side file (locale.php) with a web shell, then used that persistent access to trojanize the TrueConf client installer served to meeting participants, delivering a backdoor tracked as PhantomCore, and separately deployed a two-module backdoor called PhantomGraph that used Microsoft OneDrive for command-and-control.

Per Kaspersky, TrueConf shipped patches for both flaws on June 18, 2026, but active exploitation was detected in July 2026, indicating attacks against servers that had not yet applied the patch despite its availability. Public advisories followed on August 7, 2026, and CISA’s KEV addition came August 20. This is unrelated to an earlier, separate TrueConf Client vulnerability (CVE-2026-3502, an update-integrity flaw added to KEV in April 2026); the two incidents involve different flaws and should not be conflated.

Impact Assessment

CVE-2026-72530 carries an NVD CVSS 3.1 base score of 9.0, with high attack complexity reflecting that, in isolation, it requires an attacker to already have code execution inside TrueConf Server’s isolated environment. That precondition is trivially satisfied by chaining the flaw with CVE-2026-72529, which gives an unauthenticated attacker exactly that starting point over the same port 4307/TCP, collapsing the two into a single unauthenticated-to-SYSTEM attack path with a combined severity far higher than either flaw’s individual score suggests.

Kaspersky’s confirmed incident report shows exactly what full-chain exploitation produces in practice: attackers who escaped the sandbox obtained NT AUTHORITY\SYSTEM privileges on the host, replaced locale.php in the TrueConf web root with a web shell, then used that persistent access to trojanize the TrueConf client installer served to meeting participants, delivering the PhantomCore backdoor and a second backdoor, PhantomGraph, that used Microsoft OneDrive for command-and-control. SYSTEM-level access on the host means the attacker is no longer constrained by the sandbox at all and can access any data or credentials available to the underlying Windows or Linux operating system.

Because TrueConf Server is widely deployed in government, industrial, and regulated environments, particularly across Russia and CIS countries, and because the observed campaign already weaponized this flaw to distribute trojanized client installers to meeting participants, the impact extends beyond the compromised server itself to anyone who downloaded the tampered installer, turning a single-host compromise into a broader supply-chain-style exposure.

Affected Versions

Both Windows and Linux builds are affected. TrueConf’s security advisory page confirms the same ranges and lists the fix as shipped in 5.3.9, 5.4.9, and 5.5.5.

Remediation Steps

TrueConf has released fixed versions: 5.3.9, 5.4.9, and 5.5.5. Organizations on any earlier version should upgrade immediately.

1. Patch first. Update TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 (or later), matching your current branch.
2. Federal deadline. CISA’s BOD 26-04 sets a remediation due date of September 3, 2026 for this CVE. Note the companion missing-authentication CVE (CVE-2026-72529) carries a tighter August 23, 2026 deadline, since it requires no authentication at all and is the more directly reachable entry point.
3. Network exposure. Until patched, restrict inbound access to TCP/4307 to trusted management networks; this port should not be internet-reachable.
4. Assume compromise if exposed unpatched between June and August 2026. Because confirmed exploitation occurred in that window, treat internet-facing or loosely segmented TrueConf Servers that were unpatched during that period as potentially compromised pending investigation, rather than assuming patching alone remediates prior compromise.
5. Check for the reported IOC: a modified or unexpected locale.php under the TrueConf Server web root (observed at .../httpconf/site/public/js/locale.php on Windows) is the specific persistence artifact identified in the confirmed campaign.

Detection Guidance

• Network monitoring: Alert on inbound connections to TCP/4307 from unexpected sources, especially external IPs or hosts outside your management network.
• Privilege/process monitoring: Watch for TrueConf Server-related processes escalating to or executing as NT AUTHORITY\SYSTEM outside expected service behavior, and for unexpected child processes spawned from the TrueConf server process.
• File integrity monitoring: Monitor the TrueConf Server web root, especially locale.php under httpconf/site/public/js/, for unauthorized changes; this was the specific web shell location used in the observed campaign.
• Client installer integrity: If your server distributes client installers, verify their hashes against vendor-published values. Trojanized installers were the vector for delivering the PhantomCore backdoor to meeting participants in the observed campaign.
• Log review: Look for gaps or deletion events in TrueConf Server logs, used by attackers in the observed campaign to cover their tracks after installing the web shell.
• Endpoint indicators: Per Kaspersky, PhantomCore was delivered as api-ms-win-crt-time-l1-1-0-2.dll under %LOCALAPPDATA%\TrueConf\Client\, and PhantomGraph persisted via two services/DLLs named SysExcSvc and SysReadSvc, communicating outbound to Microsoft OneDrive.

Timeline

References

• Kaspersky ICS-CERT — KLCERT-26-058: TrueConf Server. Breakout from isolated environment
• Kaspersky ICS-CERT — Head Mare exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware
• TrueConf — Security fixes, updates, and advisories
• NVD — CVE-2026-72530
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — Hackers breach TrueConf to trojanize client installers with backdoors
• The Hacker News — Head Mare Exploits TrueConf Flaws