CVE-2026-72530: TrueConf Server sandbox breakout via crafted script code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution on the host with a CVSS 4.0 score of 9.5 and confirmed exploitation per CISA KEV.

What it is

TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break out of the isolated environment using a specially crafted script. Successful breakout leads to arbitrary code execution on the host system, which is why this carries a critical CVSS 4.0 score of 9.5 and was added to CISA KEV.

Impact

An attacker gains code execution on the TrueConf server host, with high impact to confidentiality, integrity and availability of both the vulnerable system and subsequent systems. This effectively converts a network-reachable service into full host compromise.

Attack surface

Reachable over the network via port 4307/TCP with no authentication and no user interaction required, per the CVSS vector (AV:N/PR:N/UI:N). The attack complexity is rated high (AC:H), so some conditions or timing must be met, but the entry point is the exposed TrueConf service port.

Exploitation

CVE-2026-72530 is listed in CISA KEV with a due date of 2026-09-03, and a reference is tagged Exploit, indicating known exploitation. EPSS is low at roughly 1.8 percent (77th percentile), so mass scanning is not indicated, but targeted exploitation is confirmed.

What to do

• Apply the vendor patch or mitigation for TrueConf Server per vendor and CISA BOD 26-04 instructions; if no mitigation is available, discontinue use of the product.
• Restrict network access to port 4307/TCP to trusted sources only; do not expose the TrueConf server directly to the internet.
• Isolate the TrueConf server on a segmented network with egress filtering so a sandbox breakout cannot reach other hosts.
• Follow CISA Forensics Triage Requirements for any internet-exposed TrueConf instance and treat it as potentially compromised.
• Monitor vendor advisories for updated fixed versions covering 5.3.X, 5.4.X and 5.5.X branches.

Detection

• Hunt for unexpected child processes or shell execution spawned by the TrueConf server process on the host.
• Review network logs for inbound connections to port 4307/TCP from untrusted or unexpected source addresses.
• Inspect TrueConf server logs and script or plugin directories for newly created or modified scripts around the time of suspicious activity.
• Look for outbound connections or file writes from the TrueConf host that indicate post-exploitation breakout activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.