CVE-2026-72530

What is TrueConf Server?

TrueConf Server is a self-hosted video-conferencing and unified-communications platform for Windows, deployed on-premises as an alternative to cloud meeting services. It distributes client software and runs conferencing services for an organization's users. Its network-facing role and its position as a software-distribution point make a full host compromise especially damaging: an attacker who reaches SYSTEM on a TrueConf Server can pivot into the internal network and poison the clients pushed to endpoints.

Overview

CVE-2026-72530 is a code-injection vulnerability (CWE-94) that lets an attacker who already has code execution inside TrueConf Server's isolated/sandboxed environment break out to the underlying host and execute arbitrary commands as NT AUTHORITY\SYSTEM. It is the sandbox-escape half of a two-stage chain — in observed attacks the sandbox foothold is obtained via the unauthenticated CVE-2026-72529 on TCP/4307. NVD scores it CVSS 9.0 CRITICAL with a Changed scope (S:C), reflecting the privilege boundary crossed from sandbox to host.

Affected Versions

Technical Details

The flaw is improper control of code generation within the sandboxed environment: a specially crafted script can inject and execute code that escapes the isolation boundary and runs on the host OS. The CVSS vector marks a Changed scope (S:C) — the vulnerable sandboxed component enables impact on the separately-secured host — and High attack complexity (AC:H), consistent with the exploitation prerequisite of already holding an in-sandbox foothold. Kaspersky tracks it as advisory KLCERT-26-058 (BDU:2026-11247). In practice it is chained directly after CVE-2026-72529.

Discovery

Discovered and reported by Kaspersky ICS CERT (KLCERT), alongside the companion CVE-2026-72529.

Exploitation Context

Exploitation is confirmed in the wild as part of the Head Mare campaign (see CVE-2026-72529). After escaping to SYSTEM via this flaw, the actors deployed a web shell (...\public\js\locale.php), accessed the TrueConf database, and swapped legitimate client installers with PhantomCore-trojanized versions, with a secondary PhantomGraph backdoor. Targeting focused on Russian organizations in transport, energy, IT, electronics, and software development.

Remediation

1. Upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 (or later) — the same update that fixes CVE-2026-72529.
2. Block untrusted access to TCP/4307 to cut off the CVE-2026-72529 entry point that feeds this escape, if immediate patching is not possible.
3. Hunt for post-exploitation artifacts as described for CVE-2026-72529: web shells in the web root, trojanized installers, and PhantomCore/PhantomGraph indicators.
4. Assume host compromise on any exposed, unpatched server — successful exploitation yields SYSTEM. Rebuild rather than clean where feasible, and rotate all credentials on or reachable from the host.
5. Re-verify integrity of distributed TrueConf clients and notify downstream users if trojanized installers may have been served.