Exploitation evidence
Known exploited · CISA KEV listed
Added 2026-08-20. Ransomware campaign use: Unknown.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-09-03. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
TrueConf / TrueConf Server
Default status: unaffected
- affected: * to < 5.3 (custom)
- affected: 5.3 to < 5.3.9 (custom)
- affected: 5.4 to < 5.4.9 (custom)
- affected: 5.5 to < 5.5.5 (custom)
Fixes and workarounds
Update TrueConf server to versions 5.3.9, 5.4.9 or 5.5.5.
Reported workarounds: Perform a full check with anti-virus software that has up-to-date anti-virus databases and software modules.
Sources and related reporting
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.01686,
"percentile": 0.77352
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.01686,
"percentile": 0.7721
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.01686,
"percentile": 0.77182
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.01686,
"percentile": 0.77171
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.01686,
"percentile": 0.77155
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.01686,
"percentile": 0.77118
}06 Nov 2026, 06:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.01686,
"percentile": 0.77105
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.01686,
"percentile": 0.7709
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.01686,
"percentile": 0.77048
}03 Nov 2026, 06:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72530",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-20",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T03:55:18.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"related"
],
"url": "https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-20T00:00:00.000Z",
"value": "CVE-2026-72530 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "TrueConf Server",
"vendor": "TrueConf",
"versions": [
{
"lessThan": "5.3",
"status": "affected",
"version": "*",
"versionType": "custom"
},
{
"lessThan": "5.3.9",
"status": "affected",
"version": "5.3",
"versionType": "custom"
},
{
"lessThan": "5.4.9",
"status": "affected",
"version": "5.4",
"versionType": "custom"
},
{
"lessThan": "5.5.5",
"status": "affected",
"version": "5.5",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vyacheslav Kopeytsev from Kaspersky ICS CERT"
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"cvssV4_0": {
"baseScore": 9.5,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:56:53.099Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"name": "KLCERT-26-058: TrueConf Server. Break out of the isolated environment",
"tags": [
"third-party-advisory"
],
"url": "https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update TrueConf server to versions 5.3.9, 5.4.9 or 5.5.5."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Issue discovered by Kaspersky ICS CERT and reported to TrueConf"
},
{
"lang": "en",
"time": "2026-08-04T00:00:00.000Z",
"value": "Issue confirmed by TrueConf"
},
{
"lang": "en",
"time": "2026-08-07T00:00:00.000Z",
"value": "Advisory published by Kaspersky ICS CERT"
}
],
"workarounds": [
{
"lang": "en",
"value": "Perform a full check with anti-virus software that has up-to-date anti-virus databases and software modules."
},
{
"lang": "en",
"value": "Conduct a scan for indicators of compromise. In the event of detecting indicators of compromise, change passwords for accounts that may have been compromised and contact Kaspersky ICS CERT at ics-cert@kaspersky.com for further instructions and assistance in investigating the incident."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2026-72530",
"datePublished": "2026-08-19T16:56:53.099Z",
"dateReserved": "2026-08-10T09:55:18.375Z",
"dateUpdated": "2026-08-21T03:55:18.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.01686,
"percentile": 0.77021
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2026-72530",
"cwes": [
"CWE-94"
],
"dateAdded": "2026-08-20",
"dueDate": "2026-09-03",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Unknown",
"notes": "https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530",
"product": "Server",
"requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"shortDescription": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"vendorProject": "TrueConf",
"vulnerabilityName": "TrueConf Server Code Injection Vulnerability"
}