{"timestamp":"2026-08-20T17:44:03.741756Z","id":"CVE-2026-72530","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

{"timestamp":"2026-08-19T00:00:00+00:00","id":"CVE-2026-72530","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

OR
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* versions up to (excluding) 5.3.9.10013
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* versions from (including) 5.4.0.12689 up to (excluding) 5.4.9.10072
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:windows:*:* versions from (including) 5.5.0.13826 up to (excluding) 5.5.5.10010
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* versions up to (excluding) 5.3.9.10015
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* versions from (including) 5.4.0.12700 up to (excluding) 5.4.9.10019
          *cpe:2.3:a:trueconf:trueconf_server:*:*:*:*:*:linux_kernel:*:* versions from (including) 5.5.0.13828 up to (excluding) 5.5.5.10009

CISA-ADP: https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/ Types: Exploit, Third Party Advisory

CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530 Types: US Government Resource

Kaspersky Labs: https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ Types: Third Party Advisory

2026-08-20

2026-08-20

2026-08-20

2026-08-20

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530

{"timestamp":"2026-08-19T00:00:00+00:00","id":"CVE-2026-72530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

{"timestamp":"2026-08-20T17:44:03.741756Z","id":"CVE-2026-72530","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

{"timestamp":"2026-08-19T17:16:25.283210Z","id":"CVE-2026-72530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

{"timestamp":"2026-08-19T00:00:00+00:00","id":"CVE-2026-72530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/

{"timestamp":"2026-08-19T17:16:25.283210Z","id":"CVE-2026-72530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-94

https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/

[{"vendor":"TrueConf","product":"TrueConf Server","defaultStatus":"unaffected","platforms":["Windows","Linux"],"versions":[{"version":"*","lessThan":"5.3","versionType":"custom","status":"affected"},{"version":"5.3","lessThan":"5.3.9","versionType":"custom","status":"affected"},{"version":"5.4","lessThan":"5.4.9","versionType":"custom","status":"affected"},{"version":"5.5","lessThan":"5.5.5","versionType":"custom","status":"affected"}]}]