CISA puts TrueConf Server in the exploited bucket, and port 4307/TCP does not care about your LAN

CISA has ordered federal agencies to prioritise patching two actively exploited vulnerabilities in TrueConf Server, the self-hosted messaging and video conferencing platform ^[1]. The agency added both to its Known Exploited Vulnerabilities catalog on Thursday and gave Federal Civilian Executive Branch agencies two weeks, until September 3, to secure their servers ^[7].

The first flaw is the one that should change how you think about this box. CVE-2026-72529 is a critical missing-authentication issue that lets an attacker with no privileges remotely execute arbitrary scripts on an unpatched server ^[3]. In TrueConf's own words, "a remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server" ^[4]. Undocumented critical function is doing a lot of work in that sentence.

The second, CVE-2026-72530, is also rated critical and is reachable by unauthenticated actors through high-complexity code injection attacks leading to remote code execution ^[5]. TrueConf describes it as a sandbox problem: "Improper management of code generation can allow an attacker who has achieved code execution in the TrueConf Server isolated environment to escape the sandbox and execute arbitrary commands on the underlying operating system" ^[6]. Read the two advisories together and the chain is obvious: the first bug supplies the code execution inside the isolated environment that the second bug requires in order to escape it ^[14].

The reason this lands differently from another conferencing CVE is placement. TrueConf Server is sold for secure corporate communications and, unlike Zoom or Microsoft Teams, it runs inside the organisation's own local network ^[2]. That is usually the argument for buying it, and it is also the argument teams use for slow patching: it is internal, it is not exposed, it can wait. An unauthenticated listener on a non-obvious high port sitting in the middle of a flat internal network is not a mitigation. It is a lateral movement target with a directory of everyone in the company attached to it.

CISA did not publish details of the attacks ^[9]. Kaspersky says the Head Mare hacktivist group has been exploiting both CVE-2026-72529 and CVE-2026-72530 since at least July 2026, replacing client installers with malicious versions built to deploy backdoor malware ^[10]. According to Kaspersky, multiple Head Mare campaigns hit Russian organisations across transportation, energy, IT, electronics and software development ^[11]. That is a supply chain play against the workstation fleet, not a smash-and-grab on the server. Whoever owns the conferencing server owns the update channel to every endpoint that trusts it.

There is also a pattern here. In April 2026, Check Point Research reported zero-day attacks against a different TrueConf flaw, CVE-2026-3502, in a campaign it called "Operation True Chaos" and linked to Chinese threat actors, again compromising users through trojanised client updates ^[12]. That makes at least three TrueConf CVEs reported as exploited in the wild in 2026, two of them via poisoned client software ^[13].

What to watch: whether your asset inventory knows that 4307/TCP exists, and what can reach it. Check installer and update integrity on clients that pulled from a TrueConf server before the patch, since both known exploitation campaigns went after the client distribution path rather than the server data ^[10][12]. And treat the September 3 federal deadline as the floor for your own timeline, not the ceiling ^[7]. CISA's stock warning applies exactly as written here: this class of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the enterprise ^[8].