CVE-2026-72529 TrueConf TrueConf Server
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
- CVSS
- 9.3 Critical
- EPSS
- 1.5%
- Percentile
- 74
- Published
- 2026-08-19
- Force
- 9 of 12
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
TrueConf Server Missing Authentication for Critical Function Vulnerability
- Added
- 2026-08-20
- Federal patch deadline
- 2026-08-23
- Ransomware use
- not known