CVE-2026-72529: TrueConf Server Missing Authentication RCE (KEV)

CVE-2026-72529 is a missing-authentication-for-critical-function flaw in TrueConf Server that lets a remote, unauthorized attacker who can reach port 4307/TCP invoke an undocumented function and execute an arbitrary script on the server, and Kaspersky's ICS-CERT reports it was exploited by the Head Mare threat group to deploy PhantomCore malware before a second TrueConf CVE let the attacker escape the resulting sandbox.

CVE-2026-72529 is a Missing Authentication for Critical Function vulnerability (CWE-306) in TrueConf Server. A remote, unauthorized attacker with network access to port 4307/TCP can call an undocumented function and have the server execute an arbitrary script, without needing any credentials (NVD).

NVD's vulnStatus for this record is Analyzed, but the only CVSS metric on file is a Secondary rating from Kaspersky's CNA: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 9.3 (critical). NVD has not published its own independent Primary CVSS score (NVD).

Kaspersky's ICS-CERT advisory, and TrueConf's own security-advisory page, describe the flaw identically: all TrueConf Server versions before 5.3, 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5 are affected, with fixes shipped as 5.3.9.10013+ (Windows) / 5.3.9.10015+ (Linux), 5.4.9.10018+ or 5.4.9.10072+ (Windows, per NVD's CPE data) / 5.4.9.10019+ (Linux), and 5.5.5.10010+ (Windows) / 5.5.5.10009+ (Linux), released 2026-06-18 (Kaspersky ICS-CERT Advisory; TrueConf Security Fixes, Updates and Advisories; NVD).

Kaspersky reports this vulnerability was chained with a second TrueConf flaw, CVE-2026-72530 (a sandbox-escape/code-generation issue), by the Head Mare threat actor to deploy PhantomCore malware against targets running vulnerable TrueConf Server instances (Kaspersky ICS-CERT Advisory).

CISA added CVE-2026-72529 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-20, with a required-action due date of 2026-08-23 and a forensic-triage requirement under BOD 26-04; known ransomware-campaign use is recorded as "Unknown" (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.0146 (73.617th percentile) (FIRST EPSS).

Because this flaw is already tied to a confirmed malware-deployment campaign, any TrueConf Server deployment on an affected build should be updated to the fixed versions above and reviewed against the companion CVE-2026-72530 sandbox-escape fix in the same releases.

• Missing authentication for a critical function reachable over port 4307/TCP lets an unauthorized remote attacker invoke an undocumented function and execute an arbitrary script. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 is 9.3 — both Kaspersky CNA Secondary ratings; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Affects TrueConf Server before 5.3, 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5; fixed in 5.3.9.10013+/5.3.9.10015+, 5.4.9.10018+/5.4.9.10019+, 5.5.5.10010+/5.5.5.10009+ (Windows/Linux), released 2026-06-18. — Kaspersky ICS-CERT Advisory
• Chained with CVE-2026-72530 by the Head Mare threat group to deploy PhantomCore malware. — Kaspersky ICS-CERT Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-20, due date 2026-08-23, forensic-triage required under BOD 26-04, known ransomware-campaign use recorded as "Unknown". — CISA KEV
• EPSS score is 0.0146 (73.617th percentile) as of 2026-10-30. — FIRST EPSS