CISA gives federal agencies two weeks to fix TrueConf video server flaws already being abused

Key points

• CISA ordered US federal civilian agencies on Thursday to patch two TrueConf Server flaws by September 3, 2026.
• CVE-2026-72529 lets an attacker with no login run scripts on the server over port 4307/TCP.
• CVE-2026-72530 lets an attacker break out of TrueConf's sandbox and run commands on the host operating system.
• Kaspersky ties the Head Mare hacktivist group to attacks abusing both bugs since at least July 2026, hitting Russian transport, energy, IT and software firms.
• A separate TrueConf bug, CVE-2026-3502, was used in zero-day attacks earlier in 2026 that Check Point linked to Chinese operators.

The US Cybersecurity and Infrastructure Security Agency has told federal agencies to stop what they are doing and patch their TrueConf video conferencing servers. Two serious bugs are already being used in real attacks.

TrueConf Server is a video and messaging platform companies install on their own network, rather than in the cloud like Zoom or Microsoft Teams. That means the box sitting vulnerable is usually inside the corporate walls, often trusted more than it should be.

The deadline is September 3, 2026. First reported by BleepingComputer, the order applies to Federal Civilian Executive Branch agencies, but any organisation running the product should be moving now.

What are the two bugs?

Both are critical, and both can be triggered by an attacker who has no account on the system.

The first, CVE-2026-72529, is a missing authentication check. Connect to the server on network port 4307, call an undocumented function, and you can run scripts on the box. No password, no login, nothing.

The second, CVE-2026-72530, is a sandbox escape. TrueConf runs certain code inside a walled-off area meant to contain it. This flaw lets an attacker climb out of that walled area and run whatever they want on the underlying operating system. Chain the two together and you have full control of the server from the internet.

Who is exploiting them?

Kaspersky says the Head Mare hacktivist group has been using both flaws since at least July 2026. In practice, the attackers break into the TrueConf server, then swap out the legitimate client installer that employees download with a poisoned version. When staff install what looks like a routine update, they get a backdoor, meaning hidden software that gives the attackers ongoing access to their machine.

Kaspersky's telemetry shows Russian organisations across transport, energy, IT, electronics and software development on the target list. So this is not theoretical.

Earlier in 2026, Check Point Research flagged a different TrueConf bug, CVE-2026-3502, being used in zero-day attacks it named Operation True Chaos and attributed to Chinese operators. Same playbook: trojanised client updates delivered from a hacked server.

Should ordinary users worry?

If you personally use TrueConf at work, the risk to you is the fake update trick. Do not install a TrueConf client update because a popup told you to. Ask your IT team to confirm the update is genuine before you click.

For everyone else, the wider lesson is the one the post-mortem will say out loud: an on-prem video server, sitting inside the LAN and often exposed to the internet on odd ports like 4307, is a soft target that nobody on the security team was watching closely. The failure mode here is treating conferencing kit as furniture rather than as an application server that needs patching on the same clock as everything else.

Patch the servers, rotate any credentials that touched them, and check what client installers users downloaded in the last two months. That is the operational takeaway.