CISA has added CVE‑2026‑72530 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects TrueConf Server and is tracked as the TrueConf Server Code Injection Vulnerability. An unauthenticated remote attacker who can reach port 4307/TCP can send a crafted script that escapes the application’s isolated environment and runs arbitrary code on the underlying host.
The vulnerability is a code injection issue that permits breakout from a sandboxed component. Exploitation requires network access to the TCP 4307 service and results in arbitrary code execution with the privileges of the TrueConf Server process. The CVSS base score is 9.5, rating the issue as Critical. At the time of KEV inclusion, no patch had been released by the vendor.
Because the entry appears in the KEV catalogue, active exploitation in the wild has been confirmed. No ransomware campaigns have been publicly linked to this CVE. CISA has set a remediation deadline of 3 September 2026 for federal agencies to address the flaw.
CISA directs Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26‑04 Prioritizing Security Updates Based on Risk and the Forensics Triage Requirements. Agencies must follow the applicable BOD 26‑04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders should evaluate each asset’s internet exposure and adhere to BOD 26‑04 patching guidelines. All other organisations are advised to review their exposure to TrueConf Server and apply any available mitigations.
For full details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-72530 and the CISA KEV catalogue.