CVE-2026-72529
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
An attacker on the network can run malicious code on vulnerable TrueConf servers by calling a hidden function that lacks proper access controls. This allows complete compromise of the affected system.
CWE-306 (Missing Authentication) allows unauthenticated remote code execution via an undocumented API function accessible on port 4307/TCP. Affected versions 5.3.X through 5.5.5 lack input validation and authentication enforcement, enabling arbitrary script execution with network access as the sole precondition.