CVE-2026-72529 and CVE-2026-72530 Explained: TrueConf Server Unauthenticated Script Execution and Sandbox Escape

TrueConf Server exists specifically so organizations can run video conferencing and collaboration on their own infrastructure instead of a third-party cloud service, which means the deployments that care most about TrueConf tend to be the ones with the most sensitive reasons to self-host in the first place: government agencies, defense-adjacent organizations, and enterprises with strict data residency or confidentiality requirements. A vulnerability that lets an unauthenticated attacker execute a script on that server is not a conferencing-feature bug; it is a foothold on infrastructure that was deliberately kept in-house because of what it might carry.

The two CVEs are dangerous specifically because of how they chain. CVE-2026-72529 requires nothing from an attacker except the ability to reach TCP port 4307, no account, no session, no prior access, to trigger an undocumented function and get a script running on the server; TrueConf's own security advisory page rates it at CVSS 9.8. CVE-2026-72530 then removes the safety margin that isolation or sandboxing around that script execution would otherwise provide, letting the attacker break out of that contained environment; TrueConf rates that flaw at CVSS 9.0. Individually, each flaw is critical-severity. Chained, they describe a path from network reachability alone to meaningful control over the host.

Treat any TrueConf Server instance reachable on port 4307 from an untrusted network, including the broader internal network in many flat-topology deployments, as a priority asset until you have confirmed both its exposure and its patch status. If your organization tracks CISA KEV entries against its own asset inventory as a matter of course, this is a straightforward candidate for that process; see our guide on cross-referencing asset inventory against the CISA KEV catalog if that workflow does not already exist.

Both CVEs affect TrueConf Server, the on-premises video conferencing and collaboration platform. CVE-2026-72529 is documented by CISA's KEV catalog as a missing-authentication-for-critical-function vulnerability (CWE-306) reachable over TCP port 4307, and TrueConf's own advisory rates it CVSS 9.8. CVE-2026-72530 is documented by Kaspersky ICS-CERT as a breakout-from-isolated-environment issue, consistent with a code-injection flaw (CWE-94) that lets an attacker escape sandboxing around already-achieved code execution, and TrueConf rates it CVSS 9.0.

According to TrueConf's own security advisory page, both CVEs are fixed in the 5.3.9, 5.4.9, and 5.5.5 version branches, on both Windows and Linux builds. TrueConf publishes separate build numbers per platform within each branch, so the exact minimum build differs slightly between a Windows deployment and a Linux deployment even on the same branch. Because that detail can be refined or extended in a future vendor update, treat the branch numbers above as the starting point and confirm the exact current build for your platform directly on TrueConf's advisory page rather than from this article alone.

If your environment runs TrueConf Server on any version earlier than 5.3.9, 5.4.9, or 5.5.5 for its branch, that instance needs the vendor update regardless of whether port 4307 currently appears reachable from an untrusted network.

Exploitation of both CVE-2026-72529 and CVE-2026-72530 is confirmed, not theoretical. CISA's addition of both CVEs to the KEV catalog on August 20, 2026, reflects CISA's own standard for confirmed, real-world exploitation, and NVD carries corresponding entries for both CVE IDs. TrueConf's own advisory acknowledges and fixes both issues, and Kaspersky ICS-CERT has published two separate advisories, one per CVE, with its own independent technical description of each flaw. That gives this threat four distinct organizations corroborating the core facts: CISA, NVD, the vendor itself, and an independent security research body.

What that sourcing does not yet give us is the human side of the incident: who is behind the activity, which organizations have been affected, and what attackers do after gaining execution on a compromised TrueConf Server. CISA, NVD, TrueConf, and Kaspersky ICS-CERT all corroborate that exploitation is occurring and describe how the underlying flaws work, but none of them, in our data, name a specific threat actor, intrusion set, or describe a named victim organization's incident timeline.

No threat actor, intrusion set, or ransomware operation is named in our data as being behind exploitation of either CVE. If you encounter an attribution claim elsewhere, verify it against a named vendor, CISA, or an incident response firm directly before treating it as established.

No public proof-of-concept or full technical breakdown of the exact request sequence for either CVE has been reflected in our data, so detection here is built around the behavior categories CISA and Kaspersky ICS-CERT describe rather than a single confirmed signature. Our platform maintains a detection rule titled "Unauthenticated connection to TrueConf Server hidden function on TCP/4307 (CVE-2026-72529)," translated into vendor-specific variants for Splunk, Elastic, Microsoft Sentinel and Defender, CrowdStrike, SentinelOne, Cortex XDR, QRadar, and Chronicle. Some of those vendor variants watch for the raw network connection to port 4307 itself; others watch for the TrueConf server process spawning a script immediately after such a connection, which is a closer proxy for actual exploitation rather than mere reachability.

If your organization runs TrueConf Server and forwards its logs into a SIEM, the categories worth prioritizing are network connections to TCP/4307 from source addresses outside your expected administrative range, and process creation events where the TrueConf server process spawns an unexpected child process or script interpreter. Teams building this out inside Microsoft Sentinel specifically may find our Microsoft Sentinel deployment guide useful for structuring the underlying data connector and analytics rule work before layering vendor-specific TrueConf detections on top. If you have not yet settled on a SIEM platform at all, our 2026 SIEM comparison covering Splunk, Sentinel, Elastic, Exabeam, Chronicle, and Devo walks through the tradeoffs relevant to standing up detection content like this.

Retrospective hunt queries covering the same two behavior categories, historical port-4307 connections and historical shell or script-spawn events from the TrueConf server process, are also available across the same vendor set for teams that want to sweep back through existing logs rather than wait for a forward-looking alert to fire.

Work through the following before deciding whether this is a routine patch item or something that needs incident response attention in your environment.

CISA's guidance for KEV-listed vulnerabilities in general applies directly here: apply the vendor's mitigation, follow the risk-based prioritization approach described in Binding Operational Directive 26-04, evaluate the internet exposure of every affected asset individually rather than as a blanket assumption, and discontinue use of the product if no mitigation exists for an instance that must remain internet-exposed.

The most consequential gap here is attribution, and we want to lead with it rather than bury it. CISA, NVD, TrueConf's own advisory, and both Kaspersky ICS-CERT advisories all corroborate that CVE-2026-72529 and CVE-2026-72530 exist, work the way described, and are being actively exploited. None of those four sources, in our data, names a specific threat actor, intrusion set, or victim organization, or describes what happens after an attacker gains execution on a compromised TrueConf Server. Next step: watch CISA's KEV catalog entry and TrueConf's advisory page for updates, and treat any attribution or victim-count claim you encounter elsewhere with skepticism until a named vendor, CISA, or an incident response firm confirms it directly.

Second, no public proof-of-concept or full technical writeup of the exact exploitation request sequence appears in our data. The detection and hunt guidance above is behavior-category guidance built from what CISA, TrueConf, and Kaspersky ICS-CERT describe, not a vendor-verified, TrueConf-specific signature confirmed against a known exploit sample. Next step: use the log review categories above as a starting hypothesis, and tune thresholds against your own environment's normal TrueConf traffic before trusting any single alert as a clean signal.

Third, while TrueConf's advisory page lists 5.3.9, 5.4.9, and 5.5.5 as the patched branches with separate build numbers per platform, advisory pages are updated as vendors refine guidance. Next step: confirm the current exact build number for your platform and branch directly on TrueConf's advisory page before closing out remediation, rather than relying solely on the branch numbers cited in this article.

Finally, this is a fast-moving disclosure and our data reflects sources current through early September 2026. Confirm current guidance directly against TrueConf's security advisory page and CISA's KEV catalog entry before acting on anything in this article.