Summary
generated automatically from NVD dataTrueConf Server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5, plus earlier releases, contain a missing authentication flaw (CWE-306). A remote attacker with network access to port 4307/TCP can call an undocumented function without credentials and execute an arbitrary script. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 and is listed in the CISA KEV catalog, which indicates active exploitation.
NVD description
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-08-23
EPSS · FIRST.org
1.5%probability of exploitation in the next 30 days
Higher than 73% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 août 2026
- Updated
- 21 août 2026
- Status
- Analyzed
- Source
- vulnerability@kaspersky.com
Affected products
Weaknesses (CWE)
References (3)
- https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-306
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.