CVE-2026-72529, CVE-2026-72530 Enable TrueConf Server Takeover

The two CVEs are not independent nuisances. Kaspersky’s August 11 research describes attackers using them together to connect to the TrueConf service on TCP port 4307 without authorization, execute a malicious script, escape the product’s restricted script environment, and run code as NT AUTHORITY\SYSTEM on Windows hosts. CISA’s August 20 KEV addition confirms that the exploitation threshold required for the catalog has been met.

TrueConf has fixes available in TrueConf Server 5.3.9, 5.4.9, and 5.5.5, released on June 18. Organizations still on earlier builds should treat an internet-reachable or partner-accessible server as exposed until they have upgraded and checked it for signs of tampering.

Two CVEs, one route to server takeover​

CVE-2026-72529 is the initial-access component: a missing-authentication flaw in an undocumented TrueConf Server function. According to Kaspersky ICS CERT, an unauthenticated attacker with network access to TCP port 4307 can invoke that function to execute an arbitrary script. The advisory rates the attack low complexity, requires no credentials, and requires no user interaction.

On its own, that script runs inside what TrueConf calls an isolated environment, where operating-system functions should be unavailable. CVE-2026-72530 defeats that safeguard. Kaspersky describes it as a code-injection flaw that lets an attacker use a crafted script to break out of the isolated environment and execute arbitrary code on the underlying server host.

The affected range is broad across supported server branches:

• TrueConf Server versions earlier than 5.3 are affected.
• TrueConf Server 5.3.x before 5.3.9 is affected.
• TrueConf Server 5.4.x before 5.4.9 is affected.
• TrueConf Server 5.5.x before 5.5.5 is affected.

Both Windows and Linux TrueConf Server installations are included in the vendor and Kaspersky advisories. The immediate Windows concern is straightforward: an attacker who completes the chain can move from an exposed conferencing service to SYSTEM-level control of the Windows server that hosts it.

Kaspersky’s technical breakdown explains why the pair belongs in the same remediation ticket. The authentication flaw gets malicious script execution into the server’s restricted runtime; the sandbox-escape flaw turns that foothold into operating-system command execution. Treating either CVE as a standalone patch item misses the practical attack path that has already been observed.

The danger extends to Windows clients​

CISA’s KEV entry is important because of active exploitation, but the more consequential detail comes from Kaspersky’s incident research: after compromising an unpatched TrueConf Server, the attackers replaced the legitimate TrueConf Client installer with a malicious version containing the PhantomCore backdoor.

That changes the blast radius. A compromised server is not merely a stolen meeting platform, directory, or database. It can become a distribution point for hostile software sent through a normal-looking client installation or update workflow. In the campaign Kaspersky documented, the altered installer was used to infect conference participants, while the attackers also deployed a web shell for continuing access to the server.

Kaspersky attributes the observed campaign to Head Mare, which it now characterizes as an advanced persistent threat group. Its report says the attackers replaced a file named locale.php in the TrueConf Server web directory with a web shell, collected information about the victim environment, accessed the TrueConf database, and trojanized the client distribution. It further reports that PhantomGraph components were installed as Windows services named SysExcSvc and SysReadSvc.

This is where patch-only remediation becomes inadequate. An update stops the documented entry route, but it does not remove a web shell already written to the server, reverse database access, restore a poisoned installer, or evict malware installed on endpoints. Administrators should assume that a server found on a vulnerable build requires evidence gathering and a compromise assessment before being declared clean.

What Windows administrators should check first​

Start by identifying every TrueConf Server instance, including systems installed for a department, subsidiary, lab, or isolated network. The platform’s value proposition often leads organizations to run it locally, and that can put it outside the normal inventory managed by endpoint tools or public-cloud controls.

Confirm the server’s version and upgrade to 5.3.9, 5.4.9, or 5.5.5 as appropriate. Restrict access to TCP port 4307 while remediation is in progress. Kaspersky says the port is open by default in its observed attack scenario, so the first operational question is not whether the product is supposed to be internal; it is whether untrusted networks, remote users, vendors, or exposed address ranges can actually reach that service.

Then validate client-distribution integrity. Kaspersky says the infected TrueConf installers it observed did not carry a valid TrueConf digital signature. Review the installers currently distributed from the server and compare signatures, hashes, and file provenance against known-good packages obtained directly through the vendor’s official channels. If the server has been accessible while unpatched, do not assume the copy stored locally is trustworthy merely because it bears the expected product name.

Windows security teams should also hunt for the specific persistence and execution artifacts in Kaspersky’s report, including:

• The SysExcSvc and SysReadSvc services should be investigated if they appear on a Windows TrueConf Server or affected client.
• Files named SysExcSvc.dll, SysReadSvc.dll, graphi-refresh.dat, or input_*.txt and output_*.txt under C:\Windows\System32\inetsrv\ warrant immediate review.
• A registry value under HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 is a documented persistence indicator.
• Processes spawned by trueconf_windows_update.exe, especially unusual child processes, should be reviewed against software-deployment and endpoint telemetry.
• A modified locale.php file in the TrueConf Server web path may indicate that a web shell was installed.

Kaspersky also recommends reviewing attempts to access lsass.exe, create LSASS memory dumps through comsvcs.dll, or establish SSH tunnels. Those behaviors are post-compromise activity, not proof of this exact intrusion by themselves, but their presence on a vulnerable TrueConf server sharply raises the urgency of a forensic review.

The July campaign supplies the missing context​

CISA’s alert lists the vulnerability names and confirms active exploitation, but it does not identify a malware family, threat actor, victim count, or geographic scope. Kaspersky fills in part of that gap with its account of attacks detected in July 2026 against Russian organizations in multiple sectors, including transportation, energy, IT, electronics, and software development.

According to Kaspersky, Head Mare used the TrueConf chain to gain SYSTEM-level privileges, install a web shell, and distribute PhantomCore through altered client installers. The report also says PhantomGraph used a Microsoft OneDrive account for command-and-control communications. That detail should not be read as a flaw in OneDrive; it is an example of attackers using a legitimate cloud service as infrastructure after they have obtained access.

There is an additional reason Windows administrators should pay attention even if their organization does not run TrueConf Server. Kaspersky warns that users may connect to a compromised TrueConf server operated by a partner and download a tampered client package. For enterprises that permit third-party conferencing software, endpoint controls should block or alert on unsigned installers and should not automatically trust software acquired from a meeting host.

This is also a familiar enterprise risk: a central collaboration server has relationships with many endpoints. Earlier 2026 reporting from Check Point Research on a separate TrueConf Client vulnerability showed how compromise of an on-premises server could be leveraged to distribute a malicious update across connected machines. The newly cataloged server vulnerabilities provide a direct route to compromise that central system, which is why the client-installer check should be part of response planning rather than an afterthought.

KEV status changes the priority, not the cleanup burden​

CISA’s KEV catalog is a prioritization signal built around vulnerabilities known to be exploited in real attacks. Under Binding Operational Directive 26-04, federal civilian executive-branch agencies must apply risk-based remediation requirements to qualifying KEV entries. CISA is also urging organizations outside the federal government to use KEV data in their own vulnerability-management programs.

For this pair, the practical priority is clear even for organizations not governed by the directive: patch immediately, restrict the exposed service, examine the server for persistence, and validate the integrity of every client installer it distributes. A clean version number on the server is necessary, but it is not evidence that an already-compromised TrueConf deployment is safe.

The fixed TrueConf Server releases—5.3.9, 5.4.9, and 5.5.5—have been available since June 18, before CISA’s August 20 KEV addition. Organizations that deferred the June update now need to treat the elapsed period as potential attacker dwell time and verify both the server and the Windows endpoints that trusted it.