CISA orders federal agencies to patch TrueConf flaws

CISA added the two flaws to its KEV list on Thursday and told U.S. Federal Civilian Executive Branch agencies to secure affected servers by 3 September. It said such flaws were a common route for malicious actors and a risk to federal systems.

TrueConf Server is a self-hosted messaging and video conferencing platform that runs inside a local network. TrueConf said CVE-2026-72529 let an unauthenticated attacker use port 4307/TCP to trigger a hidden function and run a script on the server.

The second flaw, CVE-2026-72530, let an unauthenticated attacker use code injection to reach remote code execution, according to TrueConf. The company also said a code-generation problem could let someone who already had code execution leave its isolated environment and run commands on the host operating system.

CISA did not give attack details. Kaspersky said Head Mare had been exploiting both flaws since at least July 2026 to replace client installers with malicious versions that installed backdoor malware, and said the campaigns had hit Russian organisations in transport, energy, IT, electronics and software development.

In April 2026, Check Point Research said attackers were using CVE-2026-3502 in zero-day attacks it named Operation True Chaos and tied to Chinese threat actors. The article did not say whether that activity was connected to the two flaws CISA later added to its list.