CVE-2026-72529

What is TrueConf Server?

TrueConf Server is a self-hosted video-conferencing and unified-communications platform, widely deployed in Russia and other markets as an on-premises alternative to cloud meeting services. It runs on Windows and provides conferencing, messaging, and client-provisioning services to an organization's users. Because it is a network-facing collaboration server that distributes client software and holds meeting infrastructure, a pre-authentication compromise gives an attacker both a foothold on internal networks and a channel to reach the organization's endpoints.

Overview

CVE-2026-72529 is a missing-authentication vulnerability (CWE-306). TrueConf Server exposes an undocumented function on TCP port 4307 that performs a critical action without any authentication check. A remote, unauthenticated attacker who can reach port 4307 can invoke it directly to execute an arbitrary script inside the server's isolated/sandboxed environment. In observed attacks it is the entry point of a chain: it is paired with CVE-2026-72530 to break out of the sandbox and reach SYSTEM on the host. NVD scores it CVSS 9.8 CRITICAL.

Affected Versions

Technical Details

The flaw is a classic missing-authentication-for-critical-function issue: a sensitive capability reachable over TCP/4307 is invocable with no credentials, allowing an attacker to run a script within TrueConf's sandboxed environment. Attack complexity is low and no user interaction is required (AV:N/AC:L/PR:N/UI:N). On its own it yields code execution confined to the sandbox; chained with CVE-2026-72530 (a code-injection sandbox escape) it becomes full host compromise as NT AUTHORITY\SYSTEM. Kaspersky tracks the issue as advisory KLCERT-26-057.

Discovery

The vulnerability was discovered and reported by Kaspersky ICS CERT (KLCERT), which also documented the in-the-wild exploitation.

Exploitation Context

Exploitation is confirmed in the wild and attributed to Head Mare, a pro-Ukrainian hacktivist group active against this flaw since July 2026. The observed chain: connect to TCP/4307 → run a script in the sandbox via CVE-2026-72529 → escape to SYSTEM via CVE-2026-72530 → replace ...\public\js\locale.php with a web shell for persistence → enumerate infrastructure, access the TrueConf database, and swap legitimate TrueConf client installers with PhantomCore-trojanized versions (with a secondary PhantomGraph backdoor using OneDrive for C2). Targeting has focused on Russian organizations across instrumentation/electronics, transport, energy, IT, and software development. Public exposure counts have not been disclosed, but the 3-day CISA remediation deadline reflects the severity.

Remediation

1. Upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 (or later) immediately.
2. Block or firewall TCP port 4307 from untrusted networks as an interim mitigation if patching cannot be done at once; the service should never be internet-exposed.
3. Hunt for compromise on any exposed, unpatched server: check ...\public\js\locale.php and other web-root files for web shells, look for trojanized TrueConf client installers, and inspect for the PhantomCore/PhantomGraph indicators (including SysExcSvc.dll / SysReadSvc.dll and OneDrive-based C2).
4. Treat distributed client installers as suspect if compromise is confirmed — attackers used the server to poison downstream endpoints; re-verify installer integrity and notify affected users.
5. Rotate credentials stored on or accessible from the server, and review the TrueConf database for unauthorized access.