TrueConf server bug can let attackers run remote code

Published August 12, 2026 CVE-2026-72529

TrueConf Server is video conferencing software companies run on their own machines. This flaw lets an outside attacker with no login run their own commands on that server just by reaching one network port.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Update availableFix recorded on Aug 26, 2026
Affected versions
before 5.3; 5.3 to before 5.3.9; 5.4 to before 5.4.9+1 more
Weakness
CWE-306Missing Authentication for Critical Function
Exploit likelihood
1.6% in 30 daysEPSS, higher than 74% of known flaws
Affects
TrueConf Server
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 20, 2026
Federal fix deadline
Aug 23, 2026

How it works

An attacker who can reach the server over port 4307 calls a hidden internal function that was never meant to be reachable without logging in, and the server runs whatever script that call sends.

What to do

Check the installed TrueConf Server version in the server's admin console or build information and compare it against 5.3.9, 5.4.9, and 5.5.5. Those builds and anything earlier are affected. TrueConf's advisory does not list an exact fixed version here, so update TrueConf Server to the latest release through TrueConf's normal update channel, block outside access to port 4307, and confirm the new version afterward.

Update TrueConf to the latest version through the built-in updater and verify your version afterward.

Technical details

CVE-2026-72529 (CVSS 9.8, CWE-306 Missing Authentication for Critical Function) hits TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier. A remote, unauthenticated attacker with network access to port 4307/TCP can call an undocumented function and have the server execute an arbitrary script, with no credentials or prior access needed. The root problem is that this internal function was never gated behind an authentication check, so anyone who can route traffic to that port can trigger it directly.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source