CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities

TrueConf Server, an on-premises video conferencing platform, contains two critical remote code execution vulnerabilities (CVE-2026-72529 and CVE-2026-72530) present in all versions since 2022. CVE-2026-72529 allows calling an undocumented function to execute arbitrary scripts, while CVE-2026-72530 enables escaping the isolated environment to execute scripts on the host system. Both vulnerabilities can be exploited remotely via TCP port 4307. The hacktivist group Head Mare has exploited these bugs to deploy PhantomCore malware by compromising the TrueConf server, replacing files with web shells, gathering infrastructure information, gaining privileged database access, and distributing malicious client installers. Backdoors were also installed on Unix-based servers using the TrueConf protocol and GitHub for C&C. The vulnerabilities were fixed in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released in June 2026. CISA has added these to its KEV catalog and recommends urgent patching.

Exploitation of these vulnerabilities allows remote attackers to execute arbitrary code on the TrueConf server, escape isolated environments, and gain privileged access to the server's database. This enables attackers to deploy malware (PhantomCore), install backdoors for persistent access, replace legitimate client installers with malicious versions, and gather sensitive information about the victim's IT infrastructure. The attacks have been observed targeting organizations in Russia and Belarus, causing destructive impacts and ransomware demands, although the threat actor is not financially motivated.

A fix is available: TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released in June 2026 address these vulnerabilities. CISA urges immediate patching, recommending that federal agencies patch CVE-2026-72529 within three days and CVE-2026-72530 within two weeks. Server owners should update to these patched versions, scan their environments for indicators of compromise and malicious artifacts, and rotate credentials for all potentially affected accounts if an intrusion is detected.