[HIGH PRIORITY] TrueConf Server Unauthenticated Script Execution (CVE-2026-72529)

⚠ HIGH PRIORITY — CISA KEV (Aug 20, 2026). CVE-2026-72529 is a missing-authentication flaw in TrueConf Server on TCP port 4307. Remote unauthenticated attackers invoke an undocumented function and execute arbitrary scripts on the Linux/Windows host — the entry point in an active exploit chain with CVE-2026-72530.

Affected TrueConf Server

• TrueConf Server < 5.3.9 on the 5.3.x branch
• TrueConf Server < 5.4.9 on the 5.4.x branch
• TrueConf Server < 5.5.5 on the 5.5.x branch
• Any build before June 18, 2026 security release
• Internet- or partner-reachable TCP 4307

Check version and exposure

trueconf-server --version
ss -tlnp | grep 4307
iptables -L INPUT -n | grep 4307

Patching Method

1. Identify branch: upgrade to 5.3.9, 5.4.9, or 5.5.5 matching your release train.
2. Follow TrueConf Server official update guide from admin console or package manager.
3. Block TCP 4307 at firewall during maintenance if server must stay online briefly.
4. Reboot TrueConf services after upgrade; confirm version in admin UI.
5. Audit server for web shells, rogue scripts, and trojanized client packages.
6. Validate integrity of client installers distributed by this server.
7. Rotate TrueConf admin, LDAP, and SIP credentials if server was exposed.

# Linux example — verify fixed build
trueconf-server --version
grep -rE 'eval|base64' /opt/trueconf/server/ 2>/dev/null | head

Until patched

• Block inbound TCP 4307 from internet and untrusted VLANs immediately
• Do not expose TrueConf to WAN without VPN fronting
• Assume compromise if port 4307 was internet-reachable on vulnerable build

CVSS: 9.8 Critical. Federal remediation deadline: 23 Aug 2026.