CVE-2026-72529: Critical severity TrueConf Server vulnerability

Q: Which systems are exposed to exploitation?

TrueConf Server instances in the listed affected version ranges are exposed if an attacker can reach TCP port 4307 over the network. Exploitation does not require authentication or user interaction.

Q: What level of access can an attacker obtain?

An unauthenticated remote attacker can execute an arbitrary script by invoking an undocumented function. The vulnerability is rated critical with high impact on confidentiality, integrity, and availability.

Published Aug 19, 2026

Updated

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Affected Software

1 affected component

TrueConf Server>=5.3.0<5.3.10, >=5.4.0<5.4.10, >=5.5.0<5.5.6, <5.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TrueConf server to a version that resolves this vulnerability.
Fixed in 5.3.9
Upgrade
Upgrade TrueConf server to a version that resolves this vulnerability.
Fixed in 5.4.9
Upgrade
Upgrade TrueConf server to a version that resolves this vulnerability.
Fixed in 5.5.5

Event History

Aug 19, 2026

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to exploitation?

TrueConf Server instances in the listed affected version ranges are exposed if an attacker can reach TCP port 4307 over the network. Exploitation does not require authentication or user interaction.

What level of access can an attacker obtain?