TrueConf Server flaw let attackers break out of its sandbox — CISA says it's already being exploited

A serious security hole in TrueConf Server, a self-hosted video conferencing platform used by organisations that prefer to run their own comms infrastructure rather than lean on the likes of Zoom or Teams, has been officially confirmed as under active attack. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72530 to its Known Exploited Vulnerabilities catalogue on 20 August 2026, which is a list reserved for bugs with evidence of real exploitation, not theoretical risk.

What the bug actually does

According to the NVD listing, the flaw sits in how TrueConf Server handles a specially crafted script sent over port 4307/TCP. Normally, that kind of script would run inside an isolated environment — a sandbox designed to stop anything malicious from touching the underlying system. This bug lets a remote attacker, with no login credentials required, break out of that sandbox entirely and execute their own code directly on the host machine.

That’s about as bad as software vulnerabilities get. Kaspersky Labs, which is credited as the source of the technical analysis, rated it 9.0 out of 10 under CVSS 3.1 and 9.5 under the newer CVSS 4.0 scale — both firmly in “critical” territory. The scoring reflects that no user interaction and no privileges are needed to pull it off, and that a successful attack can hit confidentiality, integrity and availability all at once.

The affected versions are TrueConf Server 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and anything older.

So who is actually at risk

This is not a consumer product. TrueConf Server is enterprise software: organisations install it on their own servers to run internal video meetings, typically because they want conferencing kept off third-party cloud platforms. If you’ve never heard of it, that’s because you almost certainly aren’t running it — this isn’t the kind of app that ends up on a home PC or phone by accident.

The people who need to care are IT administrators managing a TrueConf deployment, particularly in sectors or regions where the platform is popular as a Zoom or Teams alternative. NVD’s reference material also links the bug to a known intrusion campaign, associating exploitation with a hacking group tracked as “Head Mare” using malware dubbed PhantomCore — suggesting this isn’t opportunistic scanning but a deliberate, targeted operation.

Whether ransomware has been deployed alongside this exploit is, notably, listed by CISA as “unknown” — so don’t assume every compromise ends in an encryption demand. What is confirmed is unauthorised code execution on the server itself, which on its own is enough to give an attacker a serious foothold.

What to do about it

CISA has given US federal agencies running TrueConf Server until 3 September 2026 to patch, under its binding directive for prioritising fixes based on real-world risk. That deadline only legally applies to federal bodies, but the underlying advice is sound for anyone else running the software: update to a fixed version, following TrueConf’s own guidance, as a matter of urgency rather than routine maintenance.

The takeaway

This is a genuinely severe flaw with confirmed exploitation behind it, but its blast radius is narrow — organisations self-hosting TrueConf Server, not the general public. If that’s not you, there’s nothing to action here beyond noting, once again, that internet-facing conferencing servers remain a favourite target for attackers precisely because patching them tends to slip down the priority list.