CISA gives federal agencies two weeks to fix TrueConf video server flaws already being abused
Two critical bugs in the self-hosted conferencing platform let attackers run code without a password. Hacktivists have been using them since July.
Key points
- CISA ordered US federal civilian agencies on Thursday to patch two TrueConf Server flaws by September 3, 2026.
- CVE-2026-72529 lets an attacker with no login run scripts on the server over port 4307/TCP.
- CVE-2026-72530 lets an attacker escape TrueConf's isolated environment and run commands on the host operating system.
- Kaspersky ties the Head Mare hacktivist group to attacks abusing both bugs since at least July 2026, hitting Russian transport, energy, IT and electronics firms.
- A separate TrueConf bug, CVE-2026-3502, was used in zero-day attacks earlier in 2026 that Check Point linked to Chinese operators.
The US Cybersecurity and Infrastructure Security Agency has told federal agencies to patch their TrueConf video conferencing servers. Two serious bugs are already being used in real attacks.
TrueConf Server is a video and messaging platform companies install on their own network, rather than in the cloud like Zoom or Microsoft Teams. That means the vulnerable box is usually inside the corporate walls, often trusted more than it should be.
The deadline is September 3, 2026. First reported by BleepingComputer, the order applies to Federal Civilian Executive Branch agencies, but any organisation running the product should be moving now.
What are the two bugs?
Both are critical, and both can be triggered by an attacker who has no account on the system.
CVE-2026-72529 is a missing authentication check. Connect to the server on network port 4307, call an undocumented function, and you can run scripts on the box. No password. No login.
CVE-2026-72530 is a sandbox escape: TrueConf runs certain code inside a walled-off environment meant to contain it, and this flaw lets an attacker climb out and run whatever they want on the underlying operating system. Chain the two together and you've got full control of the server from the internet.
| Detail | Value |
|---|---|
| CVE-2026-72529 | Unauthenticated script execution over port 4307/TCP |
| CVE-2026-72530 | Sandbox escape to underlying OS |
| KEV added | Thursday (August 2026) |
| Federal patch deadline | September 3, 2026 |
| Known abuser | Head Mare (since July 2026) |
Who is exploiting them?
Kaspersky says Head Mare has been using both flaws since at least July 2026. The attackers break into the TrueConf server, then replace the legitimate client installer that employees download with a poisoned version. When staff install what looks like a routine update, they get a backdoor, meaning hidden software that gives the attackers ongoing access to their machine. We first covered this campaign on 8 August 2026, when Kaspersky confirmed the swapped installer was carrying the PhantomCore backdoor.
Kaspersky's telemetry shows Russian organisations across transport, energy, IT and electronics on the target list. This isn't theoretical.
In April 2026, Check Point Research flagged a different TrueConf bug, CVE-2026-3502, being used in zero-day attacks it named Operation True Chaos and attributed to Chinese operators. Same playbook: trojanised client updates delivered from a hacked server.
Should ordinary users worry?
If you use TrueConf at work, the real risk is the fake update trick. Don't install a TrueConf client update because a popup told you to. Ask your IT team to confirm it's genuine first.
The wider lesson is the one the post-mortem will say out loud: an on-prem video server sitting inside the LAN and exposed to the internet on odd ports like 4307 is a soft target nobody on the security team was watching closely. Conferencing kit gets treated like furniture rather than an application server that needs patching on the same clock as everything else. That's the failure mode here.
Patch the servers, rotate any credentials that touched them, and check what client installers users downloaded in the last two months.
