Vulnerability details

CVE-2026-72530

Actively exploited

TrueConf Server

CVSS 4.0

9.5Critical

Official description

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

CVSS scores

Score	Version	Source	Vector
9.5Critical	4.0	CVEProject cvelistV5 (CNA) (Kaspersky)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
9.0Critical	3.1	CVEProject cvelistV5 (CNA) (Kaspersky)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
TrueConf	TrueConf Server	v < 5.3	CVEProject cvelistV5 (CNA)
TrueConf	TrueConf Server	5.3 ≤ v < 5.3.9	CVEProject cvelistV5 (CNA)
TrueConf	TrueConf Server	5.4 ≤ v < 5.4.9	CVEProject cvelistV5 (CNA)
TrueConf	TrueConf Server	5.5 ≤ v < 5.5.5	CVEProject cvelistV5 (CNA)

References and advisories

https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ third-party-advisory
https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/ related
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-19
Last updated: 2026-08-21
State: Published
Assigner (CNA): Kaspersky
Kolun priority: 74 · High

CISA KEV catalog

Date added: 2026-08-20
Due date: 2026-09-03
Used in ransomware: Unknown

Exploit prediction (EPSS)

1.68%

Probability of exploitation in 30 days

77.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-94
Code Injection