Vulnerability Description
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trueconf | Trueconf Server | < 5.3.9.10013 |
Related Weaknesses (CWE)
References
- https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-frThird Party Advisory
- https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
FAQ
What is CVE-2026-72530?
CVE-2026-72530 is a vulnerability with a CVSS score of 9.0 (CRITICAL). A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to...
How severe is CVE-2026-72530?
CVE-2026-72530 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-72530?
Check the references section above for vendor advisories and patch information. Affected products include: Trueconf Trueconf Server.