CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability

criticalknown exploitedCVE-2026-72529

Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

CSIRTS triage

vendor: Johnson Controls product: Airwall, Metasys, TL280Otheraffected: Airwall prior to 4.1.0, Metasys 12 all versions, Metasys 13 all versions, Metasys 14 prior to v14.1.5, Metasys 15 prior to v15.0.1, TL280 prior to v5.62

What: Johnson Controls products contain vulnerabilities affecting building control and security systems.
Who is affected: Organizations operating Johnson Controls Airwall, Metasys, or TL280 products in the specified versions.
Urgency: Unknown severity; advisory provides version information but no exploitation details or specific technical descriptions.
Action: Review Johnson Controls security advisories linked in the bulletin and apply available patches to each affected product.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Airwall, Metasys, TL280

Get an email when a new Airwall, Metasys, TL280 advisory drops — max one per day, one-click unsubscribe.

Details

Source: CISA Known Exploited Vulnerabilities (US · database · site)
Severity: critical
Published: 2026-08-20
Exploitation: Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-72529

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation confirmedCVE-2026-72529Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 53% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-72529	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownexploitedTrueConf security advisory (AV26-835)cccs
criticalexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
criticalexploitedCVE-2026-72529: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server ve…nvd

CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability

CSIRTS triage

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from CISA Known Exploited Vulnerabilities