CVE-2026-72529 Overview
CVE-2026-72529 is a missing authentication vulnerability [CWE-306] in TrueConf Server that allows unauthenticated remote attackers to execute arbitrary scripts. The flaw exists in an undocumented function accessible via port 4307/TCP. Affected versions include TrueConf Server 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases on both Windows and Linux platforms. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and threat intelligence reporting attributes active exploitation to the Head Mare threat group deploying the PhantomCore implant.
Critical Impact
Remote attackers with network access to port 4307/TCP can execute arbitrary scripts on TrueConf Server without authentication, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- TrueConf Server 5.3.X through 5.3.9 (Windows and Linux)
- TrueConf Server 5.4.X through 5.4.9 (Windows and Linux)
- TrueConf Server 5.5.X through 5.5.5 and earlier (Windows and Linux)
Discovery Timeline
- 2026-08-19 - CVE-2026-72529 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-72529
Vulnerability Analysis
The vulnerability stems from an undocumented function exposed on port 4307/TCP that lacks authentication controls. Attackers can invoke this function directly over the network to execute arbitrary scripts on the underlying TrueConf Server host. Because the function is reachable without credentials or user interaction, exploitation can be fully automated across the internet or a corporate network.
Once triggered, the arbitrary script execution primitive gives adversaries control equivalent to the TrueConf Server service account. This exposes stored conference data, user credentials, and internal service configuration. Threat reporting from Securelist documents the Head Mare group using this flaw as an initial access vector to deploy the PhantomCore backdoor against TrueConf Server deployments.
Root Cause
The root cause is a missing authentication check on a critical function [CWE-306]. The affected server component listens on port 4307/TCP and accepts commands that invoke server-side scripting behavior, but the code path does not require any credential validation or session token. This aligns with the Kaspersky ICS-CERT advisory classification of the defect.
Attack Vector
Exploitation requires only network reachability to port 4307/TCP on the TrueConf Server. No credentials, user interaction, or prior foothold are needed. Attackers craft a request to the undocumented function to trigger arbitrary script execution. Internet-exposed TrueConf servers are directly at risk, and internal deployments become vulnerable once an adversary reaches the internal network.
See the Securelist threat analysis for observed post-exploitation activity, including PhantomCore deployment.
Detection Methods for CVE-2026-72529
Indicators of Compromise
- Unexpected inbound TCP connections to port 4307 from untrusted or external source addresses.
- Child processes spawned by the TrueConf Server service that launch shells, scripting interpreters, or download utilities.
- Presence of PhantomCore implant artifacts documented in the Securelist reporting on Head Mare activity.
- Outbound connections from the TrueConf Server host to unknown command-and-control infrastructure.
Detection Strategies
- Alert on any process execution where the parent process is the TrueConf Server binary and the child is cmd.exe, powershell.exe, /bin/sh, or similar interpreters.
- Monitor network telemetry for external or lateral connections to port 4307/TCP and baseline expected clients.
- Correlate TrueConf Server service events with new file writes to web-accessible or executable paths.
Monitoring Recommendations
- Ingest TrueConf Server logs and host process telemetry into a centralized analytics platform for retention and correlation.
- Track authentication and administrative events on the TrueConf Server host to detect account creation or privilege changes following suspicious 4307/TCP traffic.
- Continuously review CISA KEV catalog updates and threat intelligence feeds for new indicators tied to Head Mare and PhantomCore.
How to Mitigate CVE-2026-72529
Immediate Actions Required
- Upgrade TrueConf Server to a fixed release beyond 5.3.9, 5.4.9, and 5.5.5 as directed by the vendor.
- Block inbound access to port 4307/TCP from untrusted networks at the perimeter firewall until patching is complete.
- Hunt for prior exploitation using the indicators published in the Securelist analysis and the Kaspersky ICS-CERT advisory.
- Rotate credentials and secrets stored on or accessible from the TrueConf Server host if compromise is suspected.
Patch Information
Refer to the Kaspersky ICS-CERT advisory and the CISA KEV listing for CVE-2026-72529 for vendor-supplied fixed versions. Organizations should validate patch integrity and apply updates on both Windows and Linux deployments.
Workarounds
- Restrict inbound access to port 4307/TCP to a small allowlist of trusted management hosts using host-based or network firewalls.
- Place TrueConf Server behind a VPN or zero trust access broker so the service is unreachable from the public internet.
- Segment the TrueConf Server host from general user and server VLANs to limit blast radius if exploitation occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
