Summary
generated automatically from NVD dataTrueConf server versions in the 5.3.x, 5.4.x and 5.5.x branches (up to 5.5.5 and earlier) contain a code injection flaw (CWE-94) reachable over port 4307/TCP. An unauthenticated remote attacker can submit a specially crafted script that escapes the isolated environment and executes arbitrary code on the host system. The issue is rated CRITICAL with a CVSS v3.1 score of 9.0, and CISA lists it in its KEV catalog, indicating active exploitation.
NVD description
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-03
EPSS · FIRST.org
1.7%probability of exploitation in the next 30 days
Higher than 76% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 août 2026
- Updated
- 21 août 2026
- Status
- Analyzed
- Source
- vulnerability@kaspersky.com
Affected products
Weaknesses (CWE)
References (3)
- https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-94
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.