CVE-2026-72529: TrueConf Server missing authentication allows remote script execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable script execution on an internet-facing server, with CISA KEV listing and an exploit-tagged reference indicating active exploitation.

What it is

TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier expose an undocumented function on port 4307/TCP that lacks authentication. A remote attacker with network access can invoke it to execute an arbitrary script, making this a critical pre-auth remote code execution issue for exposed servers.

Impact

An unauthenticated attacker gains arbitrary script execution on the TrueConf server, which can lead to full compromise of the server and any data or sessions it handles. No confidentiality, integrity or availability impact to other components is indicated by the CVSS scope values.

Attack surface

Reachable over the network via port 4307/TCP; the CVSS 4.0 vector shows PR:N and UI:N, so no authentication or user interaction is required. Any host that can reach that port on an affected server is a potential entry point.

Exploitation

The vulnerability is listed in CISA KEV (added 2026-08-20, due 2026-08-23) and a reference is tagged Exploit, indicating active exploitation. EPSS is low at 0.01554 (73.9th percentile), so the KEV listing and exploit reporting are the stronger signals.

What to do

• Apply the vendor's patched TrueConf Server release as the first action; confirm the fixed version with TrueConf since the record does not name one.
• If no patch is available, restrict or block external access to port 4307/TCP and discontinue internet exposure of the server per CISA BOD 26-04 guidance.
• Segment affected TrueConf servers so that only trusted management networks can reach the service port.
• Follow CISA's Forensics Triage Requirements for any server that was internet-exposed, and treat it as potentially compromised.
• Track CISA KEV remediation deadlines (due 2026-08-23) and verify completion across all instances.

Detection

• Monitor network logs and flow data for unexpected inbound connections to port 4307/TCP, especially from external or untrusted sources.
• Review TrueConf server logs for calls to undocumented or unusual functions and for script or process execution spawned by the server process.
• Hunt for new or modified script files and unexpected child processes on TrueConf hosts, correlating with the Kaspersky and Securelist reporting on PhantomCore activity.
• Alert on outbound connections from TrueConf servers to unfamiliar destinations that could indicate post-exploitation command and control.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.