CVE-2026-72530: TrueConf Server Sandbox Escape to Host RCE (KEV, Head Mare/PhantomCore)

CVE-2026-72530 is a code injection flaw in TrueConf Server that lets an attacker who has already reached its isolated script-execution environment break out with a crafted script and run arbitrary commands on the host operating system, and Kaspersky's ICS-CERT and Securelist teams documented this exact flaw, chained with the companion CVE-2026-72529, being used by the Head Mare APT group in July 2026 to plant the PhantomCore backdoor on compromised TrueConf servers.

CVE-2026-72530 is a code injection vulnerability (CWE-94) in TrueConf Server, a self-hosted video conferencing platform. NVD's description states: "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, and 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system" (NVD).

NVD's status is Analyzed, but the only CVSS metrics on file are the reporting CNA's (Kaspersky) own Secondary ratings: CVSS v3.1 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 9.5 (critical). No NVD Primary score has been published, so these figures are Kaspersky's own CNA assessment, not NVD-confirmed. Attack complexity is rated High because, per Kaspersky, exploitation "may take several attempts to successfully exploit the vulnerability" (NVD).

Kaspersky's ICS-CERT advisory (KLCERT-26-058) confirms the affected range as all TrueConf Server versions before 5.3.9, the 5.4.x line before 5.4.9, and the 5.5.x line before 5.5.5, fixed in 5.3.9/5.4.9/5.5.5; the vendor was informed in August 2026 and the advisory was published 2026-08-07 (Kaspersky ICS-CERT Advisory KLCERT-26-058). TrueConf's own security-advisories page gives the exact patched builds — 5.5.5.10010+ (Windows) / 5.5.5.10009+ (Linux), 5.4.9.10018+ (Windows) / 5.4.9.10019+ (Linux), 5.3.9.10013+ (Windows) / 5.3.9.10015+ (Linux) — and describes the fix as addressing how "improper management of code generation can allow an attacker who has achieved code execution in the TrueConf Server isolated environment to escape the sandbox and execute arbitrary commands on the underlying operating system" (TrueConf Security Advisories).

Kaspersky's Securelist research team documented this flaw being used in the wild: in July 2026 — months after the June 2026 patches shipped — the "Head Mare" group (previously tracked as a hacktivist crew, now classified as an APT) exploited a two-vulnerability chain against TrueConf Server to replace legitimate client installers with trojanized versions carrying the "PhantomCore" backdoor, which established persistence through registry modifications, alongside a related two-module "PhantomGraph" backdoor that used OneDrive as a command-and-control channel. Head Mare's targets were Russian organizations in instrument manufacturing, electronics, transportation, energy, IT and software development (Securelist: Head Mare targets TrueConf Server with PhantomCore).

CISA added CVE-2026-72530 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-20, with a required-action due date of 2026-09-03, and the companion flaw CVE-2026-72529 (missing authentication, the entry point into the sandbox this CVE escapes) was added the same day; both list known ransomware campaign use as "Unknown," consistent with the documented abuse being espionage-motivated backdoor deployment rather than ransomware (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.0169 (77th percentile) — a moderate figure that likely understates real-world risk because this flaw's practical exploitation depends on first reaching the sandbox through the companion CVE-2026-72529, which should be read and patched alongside it (FIRST EPSS).

Because this is one documented stage of a chain a real APT group has already used to backdoor conferencing servers and trojanize client installers, any self-hosted TrueConf Server below 5.3.9, 5.4.9 or 5.5.5 should be patched to the builds above immediately together with the companion CVE-2026-72529 fix, and any TrueConf client installers distributed from a server that was unpatched before 2026-08-07 should be checked for tampering given the confirmed trojanized-installer technique.

• A remote unauthorized attacker with network access via port 4307/TCP to TrueConf Server 5.3.X-5.3.9, 5.4.X-5.4.9 and 5.5.X-5.5.5 could use a crafted script to break out of the isolated environment and execute arbitrary code on the host. — NVD
• NVD vulnStatus is Analyzed; the only CVSS metrics are Kaspersky's own Secondary CVSS v3.1 score of 9.0 (vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 score of 9.5; no NVD Primary score published. — NVD
• Affected all versions before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5; fixed builds 5.3.9.10013+/5.3.9.10015+, 5.4.9.10018+/5.4.9.10019+, 5.5.5.10010+/5.5.5.10009+ (Windows/Linux); fix addresses sandbox escape via improper code-generation management. — TrueConf Security Advisories
• In July 2026 the Head Mare APT group chained this flaw with CVE-2026-72529 to replace TrueConf client installers with versions carrying the PhantomCore backdoor, targeting Russian manufacturing, electronics, transport, energy, IT and software-development organizations. — Securelist: Head Mare targets TrueConf Server with PhantomCore
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-20, required-action due date 2026-09-03, ransomware campaign use listed as Unknown; companion CVE-2026-72529 added the same day. — CISA KEV
• EPSS score is 0.0169 (77th percentile) as of 2026-10-28. — FIRST EPSS