TrueConf security advisory (AV26-835)
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial Number: AV26-835 Date: August 20, 2026 As of August 19, 2026, TrueConf is affected by a vulnerability in the following product: TrueConf Server 5.3.x versions prior to 5.3.9 5.4.x versions prior to 5.4.9 5.5.x versions prior to 5.5.5 On August 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72529 and CVE-2026-72530 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. TrueConf Security Vulnerabilities, Fixes and Advisories CISA KEV: CVE-2026-72529 CISA KEV: CVE-2026-72530
CSIRTS triage
- What
- TrueConf Server contains missing authentication and code injection vulnerabilities accessible via port 4307/TCP.
- Who is affected
- Organizations running TrueConf Server versions 5.3 through 5.5 with network exposure on port 4307/TCP.
- Urgency
- Critical; both CVE-2026-72529 and CVE-2026-72530 are actively exploited and listed in CISA's KEV Catalog as of August 20, 2026.
- Action
- Immediately upgrade to TrueConf Server 5.3.9, 5.4.9, or 5.5.5 or later; isolate port 4307/TCP network access if patching cannot be done immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch TrueConf Server
Get an email when a new TrueConf Server advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/trueconf-security-advisory-av26-835
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-72529Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 53% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-72530Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 59% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-72529 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-72530 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-72530: TrueConf Server Code Injection Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-72530: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server ve…nvd
- criticalexploitedCVE-2026-72529: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server ve…nvd
More from Canadian Centre for Cyber Security
- unknownWatchGuard security advisory (AV26-847)2026-08-25
- unknownOpenSSL security advisory (AV26-846)2026-08-25
- unknownGitea security advisory (AV26-845)2026-08-25
- unknownGoogle security advisory (AV26-844)2026-08-24
- criticalOracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 22026-08-24