---
id: "CVE-2026-72529"
kind: "vulnerability"
aliases: ["CVE-2026-72529"]
title: "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "trueconf server", "fixed": ["5.3.9.10013"], "affected": "< 5.3.9.10013", "ecosystem": "vendor"}, {"name": "trueconf server", "fixed": ["5.3.9.10015"], "affected": "< 5.3.9.10015", "ecosystem": "vendor"}, {"name": "trueconf server", "fixed": ["5.4.9.10072"], "affected": ">= 5.4.0.12689, < 5.4.9.10072", "ecosystem": "vendor"}, {"name": "trueconf server", "fixed": ["5.4.9.10019"], "affected": ">= 5.4.0.12700, < 5.4.9.10019", "ecosystem": "vendor"}, {"name": "trueconf server", "fixed": ["5.5.5.10010"], "affected": ">= 5.5.0.13826, < 5.5.5.10010", "ecosystem": "vendor"}, {"name": "trueconf server", "fixed": ["5.5.5.10009"], "affected": ">= 5.5.0.13828, < 5.5.5.10009", "ecosystem": "vendor"}, {"name": "TrueConf Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "on-prem-video", "self-hosted", "trueconf", "vendor", "windows"]
not_affected_if: ["managed-hosting", "port-4307-not-exposed"]
published_at: "2026-08-19T17:21:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72529", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72529", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9,…

TrueConf Server has a missing authentication check on a critical function, reachable over the network on TCP port 4307. A remote unauthenticated attacker can run an arbitrary script on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:trueconf server affected < 5.3.9.10013 fixed 5.3.9.10013
- vendor:trueconf server affected < 5.3.9.10015 fixed 5.3.9.10015
- vendor:trueconf server affected >= 5.4.0.12689, < 5.4.9.10072 fixed 5.4.9.10072
- vendor:trueconf server affected >= 5.4.0.12700, < 5.4.9.10019 fixed 5.4.9.10019
- vendor:trueconf server affected >= 5.5.0.13826, < 5.5.5.10010 fixed 5.5.5.10010
- vendor:trueconf server affected >= 5.5.0.13828, < 5.5.5.10009 fixed 5.5.5.10009
- vendor:TrueConf Server affected ? fixed ?

## How to check

Check whether TrueConf Server is listening on TCP port 4307 and reachable from untrusted networks (unknown exact command from sources).
Review the server's network exposure and firewall rules for port 4307.
Review logs for unexpected script execution or connections to port 4307 (unknown specific indicators from sources).

## Fix

Apply the mitigations and vendor update per CISA guidance; the specific fixed version is unknown from sources.
If no mitigation is available, restrict or disconnect the product per BOD 26-04 guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72529
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-72529

## From the sources

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_