CISA Warns TrueConf Server Flaws Are Under Active Attack—Patch Before the Deadline

CISA says attackers are exploiting two critical TrueConf Server flaws over TCP/4307. Here are the affected versions, fixed releases, observed Head Mare attack chain, and defensive steps administrators should take now.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Active exploitation alert · reporting cutoff August 21, 2026, 7:25 a.m. EDT / 11:25 UTC

CISA has added two critical TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog after researchers documented attackers chaining them against a real server. Administrators should treat reachable TCP/4307 on an affected build as an urgent exposure—but reachability alone is not proof that a server has been compromised.

Original editorial security artwork showing an abstract conferencing emblem protected by a shield with a broken red isolation ring, a TCP 4307 exposed warning, CISA KEV status, and the fixed TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5; not an official TrueConf logo.
Original The IT Guys editorial artwork. It is not an official TrueConf logo and does not depict a live attack console.

Known exploitationNo authenticationTCP/4307Fixes available

Decision: preserve evidence, contain exposure, update, and then complete the investigation

TrueConf, the CVE Program records, and Kaspersky align on the affected branches and fixed versions; CISA directs stakeholders to the vendor mitigations. The observed campaign did more than crash a service: researchers report host-level execution, a web shell, access to the TrueConf database, and replacement of legitimate client installers. A version update closes the entry points; it does not automatically evict an actor or cleanse installers already replaced on a compromised server.

CVE-2026-72529Missing authentication lets a remote attacker reach an undocumented function and execute a script inside the server’s isolated environment. CVSS v3.1: 9.8.
CVE-2026-72530A code-generation flaw can let that script escape the isolated environment and execute arbitrary code on the host. CVSS v3.1: 9.0.
Affected branchesAll releases before 5.3; 5.3.x before 5.3.9; 5.4.x before 5.4.9; and 5.5.x before 5.5.5.
Federal due datesAugust 23 for CVE-2026-72529 and September 3 for CVE-2026-72530. Private organizations are not given those BOD deadlines, but active exploitation makes prompt action prudent.

What CISA added—and what KEV means

CISA added both flaws to the Known Exploited Vulnerabilities catalog on August 20. KEV is not a list of theoretical high scores: inclusion means CISA has evidence that a vulnerability has been exploited in the wild. For both entries, CISA directs covered agencies to follow vendor mitigations, apply its risk-based remediation and forensic-triage guidance, evaluate internet exposure, and discontinue use if mitigation is unavailable.

The catalog lists known ransomware-campaign use as Unknown for both flaws. That does not mean ransomware has been ruled out; it means CISA’s current entry does not establish it. CISA also does not publish a victim count, identify every affected organization, or say that every server listening on TCP/4307 has been breached.

Scope matters: CISA’s dates are directive deadlines for covered federal systems. They are still a valuable urgency signal for businesses, schools, healthcare organizations, service providers, and other TrueConf operators because exploitation is already observed.

How the observed attack chain worked

Kaspersky says it detected a new Head Mare campaign in July 2026. Its investigation found the attackers chaining two newly disclosed flaws against an unpatched TrueConf Server. The safe, defensive version of that chain is:

1. Reach serviceThe attacker connects to the TrueConf service over TCP/4307 without prior authorization.
2. Run scriptCVE-2026-72529 reaches an undocumented critical function and runs a supplied script inside the isolated environment.
3. Escape isolationCVE-2026-72530 bypasses the environment’s restrictions and reaches operating-system command execution.
4. Abuse trustResearchers report SYSTEM-level execution, a web shell, database access, and replacement of client installers.

The campaign reportedly replaced the legitimate TrueConf Client distribution hosted by the compromised server with an infected version that installed the PhantomCore backdoor for conference participants. Researchers also identified a two-module backdoor they named PhantomGraph. This makes the server a software-distribution trust problem, not merely a vulnerable communications service.

Exactly which versions are affected?

Keyboard users: focus the version table and use Left or Right Arrow to move through hidden columns.

Branch Affected Minimum fixed release Platforms
Older than 5.3 All versions Move to a supported fixed branch Windows and Linux
5.3.x Before 5.3.9 5.3.9 Windows and Linux
5.4.x Before 5.4.9 5.4.9 Windows and Linux
5.5.x Before 5.5.5 5.5.5 Windows and Linux

TrueConf’s security advisory page lists the same resolution versions. Kaspersky says those fixes were released on June 18, 2026. Administrators should prefer the latest supported release suitable for their environment rather than treating the minimum fixed build as a permanent destination.

Exposure is a conjunction—not just a product name

A system is exposed when all relevant conditions line up:

  • It is running an affected TrueConf Server build on Windows or Linux.
  • The service on TCP/4307 is running.
  • An attacker-controlled network path can reach that service—directly, through a firewall rule, VPN, NAT, load balancer, or other route.
  • For the complete observed chain, the attacker successfully executes the first-stage script and then the higher-complexity sandbox escape.

Do not assume “not listed in public search results” means unreachable. Check host listeners, IPv4 and IPv6, firewalls, cloud controls, VPN access, reverse paths, and any externally managed edge. Conversely, an open port is an exposure indicator, not forensic proof of successful exploitation.

What administrators should do now

  1. Record the current state. Identify the exact running TrueConf Server version, operating system, installation path, process start times, listening interfaces, network routes, and who owns the service. Preserve this inventory before changing it.
  2. Separate exposed from suspected compromised. If there are unexplained server changes, security detections, installer changes, unfamiliar services, database access anomalies, or evidence of web-shell activity, move into incident-response mode before routine maintenance.
  3. Preserve evidence when compromise is plausible. Retain relevant TrueConf, operating-system, web-server, endpoint-security, firewall, VPN, proxy, and identity logs; process and service timelines; installer hashes and signatures; configuration; and copies of suspicious files through an approved forensic process. Do not destroy the only evidence with an immediate cleanup.
  4. Contain unsafe reachability. Restrict TCP/4307 to explicitly required trusted paths while preserving necessary business continuity and evidence. Check both IPv4 and IPv6 and every external edge. Do not rely on a host firewall alone when cloud or upstream network controls also exist.
  5. Update every running instance. Move 5.3.x to at least 5.3.9, 5.4.x to at least 5.4.9, and 5.5.x to at least 5.5.5—or to the current supported release appropriate for the deployment. Verify all nodes, old replicas, containers, failover systems, and secondary sites.
  6. Validate distributed clients. If users downloaded TrueConf Client from the server during the suspected window, verify installer provenance, signatures, hashes, endpoint detections, and installation history from a clean administrative system. Do not assume a patched server retroactively makes earlier downloads trustworthy.
  7. Hunt for persistence and trust abuse. Kaspersky’s public reporting highlights unexpected modification of the server’s public/js/locale.php, PhantomCore detections, and services associated with PhantomGraph. Treat these as investigation leads, not a complete IOC set or proof by themselves.
  8. Rotate affected trust only after scoping. If compromise is confirmed or strongly suspected, review server, database, administrative, service, and user credentials and sessions. Rotate from a clean system according to incident-response priorities; patching alone does not invalidate stolen credentials or remove persistence.
  9. Rebuild when host trust is lost. SYSTEM-level execution means the operating system cannot be considered clean merely because antivirus removed one file. Follow organizational incident-response guidance and rebuild from trusted media where appropriate.

What ordinary TrueConf users should know

This warning centers on TrueConf Server, not proof that every TrueConf user or every conference is compromised. End users should not probe servers or attempt to reproduce the flaws. Organizations should tell users where approved installers come from, verify current client packages, and provide a reporting route for unexpected security warnings or endpoint detections.

If your organization determines that installers were replaced, affected users may need clean-device investigation and credential recovery. That decision should come from the organization’s incident-response team—not from social-media speculation.

Good news, bad news, and unknowns

Good newsFixed releases have been available since June 18, and TrueConf now maintains a public security-advisory table with affected and resolved versions.
Bad newsThe observed attack reportedly converted a conferencing server into a path for SYSTEM access and malicious client distribution.
UnknownCISA does not disclose the complete victim count, every campaign, or confirmed ransomware use.
Local boundaryNo reviewed source establishes that a Treasure Coast organization was affected. Local TrueConf operators should check exposure without assuming victimization.

Review TrueConf’s affected and fixed versions

Frequently asked questions

Does KEV mean every exposed TrueConf server was hacked?

No. KEV means CISA has reliable evidence that the vulnerability has been exploited in the wild. An affected, reachable server deserves urgent attention, but compromise must be established through logs, endpoint telemetry, file and service changes, installer provenance, and other evidence. Do not substitute a port scan or version string for an investigation.

Can administrators simply block TCP/4307 and postpone the update?

Restricting unnecessary reachability is valuable containment and defense in depth, but it is not a substitute for installing a fixed release. Internal attackers, compromised VPN accounts, misrouted networks, future firewall changes, and other trusted paths can still expose a vulnerable service. Keep the fixed software in place even if the service is temporarily restricted.

Is the TrueConf Client itself the vulnerable server component?

These two KEV entries concern TrueConf Server. The observed campaign matters to client users because attackers reportedly replaced server-hosted client installers after compromising the server. That is a distribution-trust consequence of the server breach. TrueConf’s advisory table separately lists other client vulnerabilities, which should not be conflated with this two-CVE server chain.

Sources and reporting cutoff

Checked through August 21, 2026, 7:25 a.m. EDT / 11:25 UTC. Security guidance and catalog entries can change; recheck the live sources before acting later.

  1. CISA — Known Exploited Vulnerabilities catalog feed
  2. CISA — BOD 26-04: Prioritizing Security Updates Based on Risk
  3. TrueConf — Security Vulnerabilities, Fixes and Advisories
  4. Kaspersky ICS CERT — KLCERT-26-057 / CVE-2026-72529
  5. Kaspersky ICS CERT — KLCERT-26-058 / CVE-2026-72530
  6. Kaspersky Securelist — Head Mare campaign investigation
  7. CVE Program — CVE-2026-72529 record
  8. CVE Program — CVE-2026-72530 record

This article provides defensive information. It does not include exploit code, payloads, victim identities, or instructions for probing systems you do not own or administer.

Browse Articles

Latest Articles