{"id":"CVE-2026-72530","kind":"vulnerability","aliases":["CVE-2026-72530"],"related":[],"title":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9,…","description":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"TrueConf Server has a code injection flaw that lets an unauthenticated remote attacker on the network reach port 4307/TCP, send a crafted script, escape the isolated environment, and run arbitrary code on the host. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.5,"epss":null,"exploited":true,"exploited_at":"2026-08-20T00:00:00+00:00","products":[{"name":"trueconf server","fixed":["5.3.9.10013"],"affected":"< 5.3.9.10013","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.3.9.10015"],"affected":"< 5.3.9.10015","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.4.9.10072"],"affected":">= 5.4.0.12689, < 5.4.9.10072","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.4.9.10019"],"affected":">= 5.4.0.12700, < 5.4.9.10019","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.5.5.10010"],"affected":">= 5.5.0.13826, < 5.5.5.10010","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.5.5.10009"],"affected":">= 5.5.0.13828, < 5.5.5.10009","ecosystem":"vendor"},{"name":"TrueConf Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","self-hosted","trueconf-server","vendor","windows"],"not_affected_if":["port-4307-not-exposed","product-not-installed"],"how_to_check":"Check whether TrueConf Server is running and listening on 4307/TCP (for example: ss -tlnp | grep 4307 on Linux, or netstat -ano | findstr 4307 on Windows).","fix":"Apply the vendor mitigation or patch per TrueConf instructions; CISA's required action is to follow BOD 26-04 guidance, or discontinue use if no mitigation is available.\nRestrict network access to port 4307/TCP to trusted hosts until patched.","status":"open","published_at":"2026-08-19T17:21:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:53+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:31:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per TrueConf instructions; CISA's required action is to follow BOD 26-04 guidance, or discontinue use if no mitigation is available.\nRestrict network access to port 4307/TCP to trusted hosts until patched.","summary":"TrueConf Server has a code injection flaw that lets an unauthenticated remote attacker on the network reach port 4307/TCP, send a crafted script, escape the isolated environment, and run arbitrary code on the host. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["trueconf-server","self-hosted","windows"],"confidence":0.6,"analyst_note":"Find the affected and fixed TrueConf Server versions and the vendor advisory from the CISA KEV entry and TrueConf; also confirm the host OS and whether 4307/TCP is the default port.","how_to_check":"Check whether TrueConf Server is running and listening on 4307/TCP (for example: ss -tlnp | grep 4307 on Linux, or netstat -ano | findstr 4307 on Windows).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["port-4307-not-exposed","product-not-installed"],"severity_if_unknown":"critical"},"cost_usd":0.000442,"input_tokens":2211,"output_tokens":442,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':150C,176C,207C '-2026':21A,24A '-72530':22A,25A '26':149C,175C,206C '4307/tcp':10A,67B,111C '5.3':16A '5.3.9':19A 'access':7A,108C 'accord':139C 'action':135C 'activ':87B 'adher':203C 'allow':101C 'appli':136C 'applic':173C 'arbitrari':78B,127C 'asset':197C 'attack':4A,61B,105C 'base':154C 'bod':148C,174C,205C 'break':119C 'cisa':83B,133C,146C,163C 'cloud':179C 'code':53B,79B,96C,128C 'complianc':144C 'contain':94C 'could':100C 'craft':70B,116C 'cve':20A,23A 'discontinu':182C 'ensur':143C,202C 'environ':75B,124C 'escap':72B 'evalu':195C 'execut':126C 'exploit':40B,88B 'exposur':200C 'flaw':55B 'follow':172C 'forens':165C 'guidanc':161C,177C 'guidelin':209C 'host':43B,82B,131C 'inject':54B,97C 'instruct':142C 'internet':199C 'isol':74B,123C 'let':57B 'list':84B 'mitig':137C,188C 'network':6A,64B,107C 'note':160C,171C 'patch':208C 'port':9A,66B,110C 'priorit':151C 'product':186C 'reach':65B 'remot':2A,60B,104C 'requir':134C,167C 'respons':193C 'risk':156C 'run':77B 'script':71B,117C 'secur':152C 'see':157C,168C 'self':42B 'self-host':41B 'send':68B 'server':14A,27A,29A,31A,33A,35A,37A,39A,46B,50B,93C 'servic':180C 'special':115C 'stakehold':191C 'system':132C 'triag':166C 'trueconf':13A,26A,28A,30A,32A,34A,36A,38A,45B,49B,92C 'trueconf-serv':44B 'unauthent':59B 'unauthor':3A,103C 'unavail':190C 'updat':153C 'url':158C,169C 'use':113C,183C 'vendor':47B,141C 'version':15A 'via':8A,109C 'vulner':98C 'wild':91B 'window':48B 'x':17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-19T17:21:01+00:00","kev":{"dateAdded":"2026-08-20","dueDate":"2026-09-03","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@kaspersky.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-72530","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72530","severity":null,"published_at":"2026-08-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-72530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72530","severity":null,"published_at":"2026-08-19T17:21:01+00:00","modified_at":"2026-08-21T04:18:15+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}