[HIGH PRIORITY] TrueConf Server Sandbox Escape RCE (CVE-2026-72530)

⚠ HIGH PRIORITY — CISA KEV (Aug 20, 2026). CVE-2026-72530 is a code-injection / sandbox-breakout flaw in TrueConf Server. Chained after CVE-2026-72529, attackers escape the isolated environment and execute scripts on the underlying host — enabling full server takeover and poisoned client distribution.

Affected TrueConf Server

• Same version ranges as CVE-2026-72529 (fixed in 5.3.9 / 5.4.9 / 5.5.5)
• Self-hosted video conferencing on Linux or Windows
• Deployments where TCP 4307 is reachable from compromised workstation or WAN

Check for compromise

trueconf-server --version
find /opt/trueconf -mtime -14 -type f -name '*.sh' 2>/dev/null
ls -la /opt/trueconf/server/clients/ 2>/dev/null

Patching Method

1. Apply same fixed builds: 5.3.9, 5.4.9, or 5.5.5 (released June 18, 2026).
2. Patch CVE-2026-72529 first — it is the unauthenticated entry point.
3. Preserve logs before reboot; review TrueConf and system logs for July–Aug activity.
4. Scan client download directory for modified MSI/DEB packages.
5. Re-image server if web shells or backdoors found — patching alone does not evict persistence.
6. Force client reinstall from verified vendor packages on all endpoints.
7. Enable file-integrity monitoring on TrueConf install path.

sha256sum /opt/trueconf/server/clients/*.deb
journalctl -u trueconf-server --since '2026-07-01' | grep -i error

Until patched

• Isolate TrueConf server from production network segment
• Disable automatic client update distribution until integrity verified
• Restrict TCP 4307 to management jump-host IP allowlist

CVSS: 9.5 Critical. Federal remediation deadline: 3 Sep 2026.