CVE-2026-72530: TrueConf Server RCE Vulnerability

CVE-2026-72530 Overview

CVE-2026-72530 is a critical code injection vulnerability [CWE-94] in TrueConf Server. A remote unauthenticated attacker with network access to TCP port 4307 can submit a specially crafted script that breaks out of the isolated execution environment and runs arbitrary code on the underlying host. The flaw affects TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases on both Windows and Linux. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, and Kaspersky ICS CERT attributes in-the-wild exploitation to the Head Mare group deploying the PhantomCore implant.

Critical Impact
Unauthenticated remote code execution on the TrueConf Server host, enabling full compromise of the conferencing infrastructure and lateral movement into the enterprise network.

Affected Products

TrueConf Server for Windows (versions 5.3.X–5.3.9, 5.4.X–5.4.9, 5.5.X–5.5.5, and earlier)
TrueConf Server for Linux (versions 5.3.X–5.3.9, 5.4.X–5.4.9, 5.5.X–5.5.5, and earlier)
Any deployment exposing TCP port 4307 to untrusted networks

Discovery Timeline

2026-08-19 - CVE-2026-72530 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-20 - Added to CISA Known Exploited Vulnerabilities catalog

Technical Details for CVE-2026-72530

Vulnerability Analysis

The vulnerability resides in the scripting subsystem exposed on TCP port 4307, which processes attacker-supplied scripts inside what is intended to be an isolated interpreter. The isolation boundary is incomplete, allowing crafted script content to reach host-level APIs and execute arbitrary operating system commands. Because the port accepts input without authentication, any network-reachable attacker can trigger the flaw. Kaspersky researchers observed the Head Mare threat cluster weaponizing the issue to install the PhantomCore remote access tool on compromised TrueConf servers.

Root Cause

The underlying defect is improper control of code generation, tracked as [CWE-94]. The server evaluates script primitives without enforcing a strict allowlist on reachable objects, methods, or reflective constructs. A specially crafted payload references native handlers that fall outside the intended sandbox surface. Once the interpreter resolves those handlers, script logic executes in the context of the TrueConf Server process on the host.

Attack Vector

Exploitation requires only network access to port 4307/TCP on a vulnerable TrueConf Server. The attacker connects to the scripting endpoint, submits a payload that escapes the interpreter sandbox, and gains code execution with the privileges of the server process. On typical deployments this yields administrative access to the host and downstream identity data cached by the conferencing service. Refer to the Kaspersky Security Advisory and the Securelist Threat Analysis for detailed reverse-engineering notes on the exploit chain.

Detection Methods for CVE-2026-72530

Indicators of Compromise

Inbound connections to TCP port 4307 from unexpected external or internal source addresses.
Child processes spawned by the TrueConf Server service that launch shell interpreters (cmd.exe, powershell.exe, /bin/sh, /bin/bash).
Presence of PhantomCore implant artifacts described in the Securelist Head Mare analysis, including unexpected persistence entries and outbound C2 traffic.
New or modified files under the TrueConf installation directory that were not delivered by an official update.

Detection Strategies

Alert on any process ancestry where the TrueConf Server service invokes scripting engines, download utilities, or reconnaissance binaries such as whoami, net, nltest, or curl.
Correlate authentication logs and firewall telemetry for anonymous sessions on port 4307 followed by outbound network connections initiated by the server.
Hunt across endpoint telemetry for the PhantomCore loader hashes and TTPs referenced in the Kaspersky and Securelist publications.

Monitoring Recommendations

Restrict and log all traffic to port 4307 at perimeter and internal firewalls, treating any external exposure as a high-severity finding.
Enable command-line auditing on the TrueConf host and forward logs to your SIEM for retention and correlation.
Baseline the normal parent-child process tree of the TrueConf service so anomalous execution stands out during triage.

How to Mitigate CVE-2026-72530

Immediate Actions Required

Upgrade TrueConf Server to a fixed release above 5.5.5 as identified in the vendor advisory, prioritizing internet-facing instances.
Block TCP port 4307 at the network perimeter and restrict internal access to a defined allowlist of management hosts.
Assume compromise on any internet-exposed server running an affected version and begin incident response, including credential rotation and host reimaging.
Review the CISA Known Exploited Vulnerabilities entry for federal remediation deadlines.

Patch Information

TrueConf has released fixed builds that resolve the sandbox escape. Administrators should consult the Kaspersky Security Advisory for the exact fixed version mapping and follow the vendor upgrade procedure for both Windows and Linux deployments. Verify installed versions after patching and confirm the scripting endpoint on port 4307 is no longer reachable from untrusted networks.

Workarounds

Place TrueConf Server behind a VPN or bastion host so port 4307 is unreachable from untrusted networks.
Apply host-based firewall rules that permit connections to port 4307 only from validated conferencing clients.
Run the TrueConf Server service under a least-privilege account to limit the blast radius if exploitation succeeds prior to patching.

bash

# Example: restrict TrueConf Server port 4307 to a trusted management subnet
# Linux (iptables)
iptables -A INPUT -p tcp --dport 4307 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4307 -j DROP

# Windows (PowerShell)
New-NetFirewallRule -DisplayName "Block TrueConf 4307 External" \
  -Direction Inbound -Protocol TCP -LocalPort 4307 \
  -RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block TrueConf 4307 Default" \
  -Direction Inbound -Protocol TCP -LocalPort 4307 -Action Block