TrueConf Server bug now on CISA's exploited-in-the-wild list — should you care?

What’s actually going on

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in TrueConf Server, a video-conferencing platform, to its Known Exploited Vulnerabilities catalogue on 20 August 2026. That listing only happens once there’s confirmed evidence of real-world attacks — this isn’t a theoretical bug sat in a lab report. US federal agencies running the software have been told to patch or mitigate by 23 August.

Tracked as CVE-2026-72529, the issue lives in an undocumented function that a remote attacker can call over network port 4307/TCP without needing to log in first. According to the NVD entry, successful exploitation lets an attacker execute an arbitrary script on the server — effectively handing over control without ever having to authenticate. Kaspersky Labs, which submitted the vulnerability, rates it 9.8 out of 10 on the CVSS 3.1 scale and 9.3 on the newer CVSS 4.0 scale — both comfortably in “critical” territory.

How bad is it, really

Missing-authentication bugs of this kind are about as serious as it gets, because there’s no password to steal or phishing email to fall for — the door is simply left open. NVD’s references point to a Kaspersky ICS-CERT advisory describing it as a “missing authentication for critical function” issue, and separately cite a Securelist writeup linking exploitation to a threat group tracked as “Head Mare,” reportedly using it alongside malware dubbed PhantomCore. We haven’t seen the full technical breakdown of that campaign, so we can’t independently verify the scale or targeting beyond what NVD’s citation implies — but its presence on CISA’s KEV list is itself the hard confirmation that abuse has happened, not merely a risk that it might.

The affected versions are TrueConf Server 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases.

So who is actually at risk

This is squarely an enterprise and organisational problem, not a consumer one. TrueConf Server is self-hosted video-conferencing software typically deployed by businesses, government bodies or institutions that want to run their own conferencing infrastructure rather than use a cloud service like Zoom or Teams. If you’ve never heard of TrueConf, you almost certainly don’t run it, and nothing about this vulnerability touches ordinary consumer apps, phones or laptops.

The people who do need to pay attention are IT administrators responsible for TrueConf Server deployments — particularly anyone exposing that server, or port 4307 specifically, to the wider internet. CISA’s mandatory deadline only legally applies to US federal agencies, but the KEV catalogue is widely treated by security teams everywhere, including in the UK, as a practical priority list: if it’s on there, attackers are already using it, so the usual “patch when convenient” approach doesn’t really apply.

What to do about it

If you administer TrueConf Server, the advice is straightforward: update to a fixed version following the vendor’s own guidance, and in the meantime restrict or firewall off access to port 4307 from untrusted networks. CISA’s standard recommendation for KEV entries is to apply vendor mitigations and follow its broader guidance on prioritising security updates by risk.

For everyone else, this is a case worth noting for the record rather than losing sleep over. It’s a genuine, actively exploited flaw — but a narrow one, confined to a specific enterprise product that most people will never install, let alone administer.