CISA added two actively exploited flaws in TrueConf Server to its KEV catalog. CVE-2026-72529 (CVSS 9.3) is a missing-authentication bug — an undocumented function on port 4307/TCP lets an unauthenticated attacker run an arbitrary script. CVE-2026-72530 (CVSS 9.0) is a code-injection / sandbox-escape bug that yields full code execution on the host. Chained, they give complete server takeover.
Kaspersky found the attackers going further than plain RCE. They replace the client installer with a malicious version, so users pull a trojanized client from a legitimate-but-compromised server. That is a supply-chain attack. Fixes shipped in June in versions 5.3.9, 5.4.9, and 5.5.5.
Why this matters in Cyprus
Many Cyprus organisations run a self-hosted conferencing or collaboration server on the perimeter, tied to corporate accounts. One exploited box can become a malware-distribution point to the whole company and its contacts — and under GDPR and NIS2, that’s a reportable incident. If your server was internet-facing, assume the installer could have been tampered with and verify endpoints.
Get ahead of it
- Update TrueConf Server to 5.3.9 / 5.4.9 / 5.5.5 or later now.
- Block port
4307/TCPfrom the internet; restrict access to trusted IPs. - Check client-installer hashes and endpoints for backdoors.
We map exposed services and internal exposure with external and internal network penetration testing, and prove the blast radius with an assumed-breach assessment. Get a fixed-price quote.
Sources: CISA KEV; Kaspersky reporting on Head Mare; BleepingComputer, SecurityWeek, SecurityAffairs; TrueConf advisory.