CVE-2026-72529

EUVD-2026-62587
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
KasperskyCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
trueconftrueconf
𝑥
< 5.3
CNA
trueconftrueconf
5.3 ≤
𝑥
< 5.3.9
CNA
trueconftrueconf
5.4 ≤
𝑥
< 5.4.9
CNA
trueconftrueconf
5.5 ≤
𝑥
< 5.5.5
CNA
Common Weakness Enumeration
References
https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/
https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/