CVE-2026-72530

nvd.nist.gov • August 21, 2026

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in TrueConf Server Exploited via TCP Port 4307 Two critical vulnerabilities, CVE-2026-72530 and CVE-2026-72529, have been identified in TrueConf server versions 5.3.X to 5.5.5, allowing remote unauthorized attackers to exploit the server via TCP port 4307. CVE-2026-72530 enables attackers to execute arbitrary code by breaking out of an isolated environment, while CVE-2026-72529 allows script execution through an undocumented function. Both vulnerabilities were published on 2026-08-19 and added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-20 due to active exploitation. Organizations using affected TrueConf server versions are at significant risk and are advised to review CISA's guidance for mitigation. Immediate action is recommended to secure systems against these vulnerabilities. 73

Extracted Entities

CVE-2026-72530

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)