CISA has added CVE‑2026‑72529 to its Known Exploited Vulnerabilities catalogue. The flaw affects TrueConf Server and is described as a missing authentication for critical function vulnerability that allows a remote, unauthenticated attacker with network access via port 4307/TCP to execute an arbitrary script.
The vulnerability is an authentication bypass leading to arbitrary code execution. It is reachable over TCP port 4307 and carries a CVSS base score of 9.8, rating it as critical. No patch or advisory from the vendor is currently listed, and the patch status is marked as unknown.
Active exploitation has been confirmed, which is the basis for the KEV designation. There is no public indication that this flaw has been used in ransomware campaigns. CISA has set a remediation deadline of 26 August 2026 for federal civilian executive branch agencies to address the issue.
CISA requires that stakeholders apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26‑04 Prioritising Security Updates Based on Risk and the Forensics Triage Requirements. For cloud services, follow the applicable BOD 26‑04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26‑04 patching guidelines. While the directive binds FCEB agencies, all organisations should review their exposure to TrueConf Server and take appropriate protective measures.
For full details, consult the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-72529 and the CISA KEV catalogue.