CVE-2026-72529 and CVE-2026-72530: TrueConf Server's Unauthenticated RCE Chain, Patch Guide

Two bugs in a video conferencing server most security teams have never had reason to think about just landed on CISA’s Known Exploited Vulnerabilities catalog in the same week, and a hacktivist group has reportedly been chaining them together since July. If your organization runs TrueConf Server for internal meetings, this is not a “patch it next sprint” bug. It’s an unauthenticated path to code execution, already weaponized, with a federal remediation deadline already ticking.

What’s actually broken

TrueConf Server exposes a service on TCP port 4307 that, it turns out, includes an undocumented function reachable without any authentication at all. That’s CVE-2026-72529: a remote, unauthenticated attacker who can reach that port sends the right request and gets the server to execute an arbitrary script. No login, no session token, no prior foothold required beyond network reachability.

CVE-2026-72530 sits one step further in. TrueConf runs certain scripts inside an isolated execution environment, presumably as a safety boundary for whatever that undocumented function was meant to do. The second flaw is a way to break out of that sandbox: a specially crafted script escapes the isolation and runs arbitrary code directly on the host, with the privileges of the TrueConf service. Chain the two together and an attacker goes from “can reach port 4307” to “has code execution on the server” without ever needing a valid account.

Attacker on the network
  -> connects to TCP 4307 (no auth required)
  -> invokes undocumented function (CVE-2026-72529)
  -> submits crafted script
  -> escapes TrueConf's execution sandbox (CVE-2026-72530)
  -> arbitrary code execution on the host

Who’s using it, and for what

Security researchers tie active exploitation of this chain to the Head Mare hacktivist group, which has reportedly been running it since at least July 2026, weeks before CISA’s KEV listing made it public. The reported objective isn’t the usual ransomware playbook. Head Mare has apparently been using server-side access to replace legitimate TrueConf client installers with malicious versions, turning a trusted internal download into a backdoor delivery mechanism for anyone in the organization who pulls the client from that server afterward.

That’s a meaningfully different threat model than a typical RCE. It’s not just “this server gets compromised.” It’s “every person in this organization who trusts this server enough to download a video conferencing client from it becomes a second-stage target,” which is the kind of blast radius that makes a niche internal tool’s vulnerability worth the same urgency as an internet-facing edge appliance CVE.

Patch status and deadlines

TrueConf has shipped fixed releases for each affected branch:

Branch	Vulnerable	Patched
5.3.x	up to 5.3.8	5.3.9
5.4.x	up to 5.4.8	5.4.9
5.5.x	up to 5.5.4	5.5.5

CISA’s Known Exploited Vulnerabilities catalog carries a binding remediation deadline for U.S. federal civilian agencies: August 23 for CVE-2026-72529 and September 3 for CVE-2026-72530. Those dates are a floor, not a ceiling, for everyone else. A KEV listing means confirmed exploitation, not theoretical risk, and the fact that CISA gave the two bugs slightly different deadlines is itself informative: CVE-2026-72529 (the unauthenticated entry point) is being treated as the more urgent of the pair, which lines up with it being the half of the chain an attacker needs first.

What to actually do

1. Identify every TrueConf Server instance in your environment, including ones deployed by individual teams outside central IT’s inventory. Video conferencing tools have a habit of getting stood up informally and then forgotten.
2. Patch to 5.3.9, 5.4.9, or 5.5.5 on whichever branch you run. If you’re on an older, unsupported branch, treat this as a forcing function to upgrade rather than a reason to wait for a branch-specific fix that may not come.
3. If patching can’t happen today, block inbound access to TCP 4307 from any untrusted network at the firewall. This closes the unauthenticated entry point CVE-2026-72529 depends on, though it’s a mitigation, not a substitute for the patch.
4. Audit client installer distribution. If your TrueConf Server has been serving client downloads to end users since before the patch, verify the integrity of those installers and consider it possible that any client pulled from that server during the exposure window is untrustworthy.
5. Check logs for connections to port 4307 from unexpected sources, particularly anything predating today’s patch. Head Mare’s reported activity since July means exploitation may already have happened before this was public.

Unauthenticated RCE chains in software most teams treat as “just a meeting tool” are exactly the kind of gap that KEV-driven triage exists to catch, because CVSS scoring alone rarely reflects how a tool actually sits in your network. If your patch cadence is still built around monthly severity reviews instead of active-exploitation feeds, our team can help build a triage process that would have caught this the week it started, not the week it made headlines.