TrueConf Server Code Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.0Security Advisory

TL;DR 📌

  • TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
  • Highest CVSS: 9.0 (Critical).
  • Listed in CISA KEV (2026-08-20) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-72530.

What it is

CVE-2026-72530 is a code injection vulnerability in TrueConf Server. An attacker with network access to port 4307/TCP can submit a specially crafted script that breaks out of the server’s isolated execution environment and runs arbitrary code on the underlying host.

No authentication is required (PR:N, UI:N), and the flaw is reachable directly over the network rather than requiring local or management-plane access. The CVSS vector shows a scope change (S:C), reflecting that the code execution occurs outside the originally isolated component, and confidentiality, integrity and availability impacts are all rated high. CVSS 3.1 gives this 9.0, critical, though attack complexity is rated high (AC:H), meaning exploitation depends on conditions beyond simply reaching the port.

The advisory does not describe the specific mechanics of the isolation being broken, nor which TrueConf Server function exposes port 4307/TCP; consult the vendor advisory for those details.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-20, so it is known to be exploited.

What to do

  • Check whether port 4307/TCP is reachable from untrusted networks and restrict access to it immediately if it is not already firewalled to trusted hosts only.
  • Consult the TrueConf advisory for a fixed release — none is listed in the available data, so check directly with the vendor for patch status and timing.
  • Given the KEV listing, treat this as a priority for remediation tracking and reporting under any KEV-driven patching obligations your organisation follows.
  • Review logs for TrueConf Server for signs of unusual script execution or process activity, since the vulnerability allows arbitrary code execution on the host once triggered.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.0) across any TrueConf kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source