CISA added CVE-2026-72529 and CVE-2026-72530 in TrueConf Server to its Known Exploited Vulnerabilities catalog on August 20, confirming evidence of active exploitation. TrueConf released fixed builds 5.3.9, 5.4.9, and 5.5.5 on June 18. Administrators should update now, review exposure on TCP port 4307, and investigate the server instead of treating installation of the patch as proof that no earlier compromise occurred.
The incident can extend beyond the server. Kaspersky observed an attacker replace a legitimate TrueConf Client distribution on a compromised partner server with an unsigned build carrying the PhantomCore backdoor. That creates two different response paths: one for server operators and another for people who downloaded and ran a client from the affected infrastructure.
Who needs to act?
| Your situation | What to do now |
|---|---|
| You operate TrueConf Server 5.3.x, 5.4.x, or 5.5.x | Install at least 5.3.9, 5.4.9, or 5.5.5 for the matching branch, then preserve and review logs and server artifacts. Prefer the latest supported release approved for your environment. |
| You run TrueConf Server 5.2 or older | Contact TrueConf support and plan a move to a supported fixed build. Do not expose TCP 4307 broadly while the migration is pending. |
| You received only a meeting link and installed nothing | The observed client-delivery chain does not establish infection from receiving or joining a meeting alone. Verify the organizer and avoid unexpected update prompts. |
| You downloaded TrueConf Client but did not run it | Check the file’s digital signature before opening it. If TrueConf is not the valid signer, quarantine the file and contact the organization that supplied the download. |
| You ran an unsigned TrueConf installer | Disconnect the Windows PC from sensitive networks, preserve the file and alert details, scan for malware and persistence, and rotate exposed credentials from a clean device. |
How the two TrueConf flaws fit together
CVE-2026-72529 is a missing-authentication vulnerability in a critical function. An unauthenticated remote attacker with network access to the affected service can make the server execute an arbitrary script. CVE-2026-72530 is a code-injection vulnerability that lets the attacker escape the isolated environment and execute arbitrary code.
Kaspersky’s incident report describes the attacker connecting without authentication through TCP port 4307, invoking a server function with a malicious script, breaking out of the isolated environment, and obtaining execution as NT AUTHORITY\SYSTEM. The attacker then replaced ...\public\js\locale.php with a web shell and used privileged database access.
The compromised server also became a software-distribution foothold. The original TrueConf Client package was replaced with a trojanized, unsigned version carrying PhantomCore. Kaspersky later found PhantomGraph modules named SysExcSvc.dll and SysReadSvc.dll, OneDrive-based command traffic, LSASS access, and a reverse SSH tunnel. Those are incident artifacts from the observed campaign, not a checklist proving every exposed TrueConf server was compromised in the same way.
TrueConf Server response checklist
- Identify the installed branch. Record the current version and update path before changing the system. For 5.3.x use 5.3.9 or later; for 5.4.x use 5.4.9 or later; for 5.5.x use 5.5.5 or later. Contact TrueConf for supported migration from 5.2 and older.
- Restrict TCP 4307. Check whether the port is reachable from the internet or untrusted networks. Limit access to the systems that require it; a closed port is risk reduction, not evidence that the host is clean.
- Preserve evidence before cleanup. Export relevant application, web, authentication, firewall, EDR, and proxy logs. Record timestamps, listening services, unusual child processes, and recent administrative changes.
- Inspect the web and distribution roots. Compare
locale.php, TrueConf Client packages, and nearby modified files with trusted vendor copies. Review web shells, unexpected scripts, database changes, and newly created privileged accounts. - Hunt for follow-on access. Look for the reported service DLL names, suspicious OneDrive traffic, LSASS access, reverse SSH tunnels, unfamiliar services, scheduled tasks, and outbound connections. Absence of one published indicator does not exclude another payload.
- Rotate secrets after containment. If compromise is suspected, invalidate server credentials, service accounts, API keys, certificates, and administrative sessions from a trusted system. Rebuild from known-good media when integrity cannot be established.
CISA’s remediation dates—August 23 for CVE-2026-72529 and September 3 for CVE-2026-72530—are requirements for US federal civilian agencies. Other organizations should not interpret the later date as a safe patch window. The Windows IKE KEV response guide explains the same important distinction between applying a fix and investigating earlier exposure.
Check a downloaded TrueConf Client
Kaspersky says the malicious TrueConf Client it observed did not have a valid TrueConf digital signature. In Windows, right-click the installer, open Properties → Digital Signatures, select the signature, and confirm that Windows reports it as valid and the signer matches the vendor. A familiar filename, icon, or HTTPS download address is not enough if the supplying server itself was compromised.
If the file was never executed, quarantine it and notify the organization that provided the link so it can examine its server. If it ran, isolate the PC and inspect services, startup entries, scheduled tasks, recent downloads, security-tool exclusions, unusual PowerShell activity, and outbound connections. A full Gridinsoft Anti-Malware scan can check Windows for detected payloads and persistence. A clean scan cannot prove that a backdoor never ran or recover credentials already accessed, so rotate important work, email, browser, VPN, and password-manager secrets afterward from a clean device.
Do not confuse this chain with every fake conferencing-app download. The Starland RAT fake Zoom and WebEx installer guide covers lookalike download sites; this TrueConf incident matters because an attacker was observed abusing a legitimate partner server.
What CISA’s listing does and does not prove
The KEV entry confirms that both vulnerabilities have been exploited in the wild. CISA does not provide a public victim count and lists ransomware use as unknown. Kaspersky reports targeting of Russian organizations in manufacturing, electronics, transport, energy, IT, and software, but that observed set is not a complete global census.
Likewise, patching closes the documented vulnerability path but does not remove a web shell, trojanized client package, stolen credential, or follow-on backdoor already present. Treat the version check, server investigation, and endpoint response as related but separate tasks.
References
- CISA. “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” August 20, 2026. KEV addition and remediation requirements.
- Kaspersky Securelist. “Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server,” August 11, 2026. Attack chain, artifacts, and client-signature findings.
- TrueConf. “TrueConf Server: Security Updates for June 2026,” June 18, 2026. Vendor fixed builds and update guidance.
