TrueConf Server Missing Authentication for Critical Function Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-20) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-72529.

What it is

CVE-2026-72529 is a missing authentication for critical function vulnerability in TrueConf Server. A critical function is reachable over the network on port 4307/TCP without any authentication check.

An attacker only needs network access to that port — no credentials, no user interaction, and no prior foothold on the system. The CVSS vector confirms this: attack vector is network, attack complexity is low, no privileges or user interaction are required.

The result of reaching this function is arbitrary script execution. Combined with the unauthenticated access path, this gives a remote attacker full compromise of confidentiality, integrity, and availability, which is reflected in the 9.8 CRITICAL score.

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 20 August 2026, so it is known to be exploited.

What to do

  • Treat this as urgent. Given KEV listing and the unauthenticated, network-reachable path, prioritise this above routine patching cycles.
  • Check the TrueConf advisory for a fixed release; none is listed in the facts available at time of writing, so consult TrueConf directly for current remediation guidance.
  • Restrict network exposure of port 4307/TCP immediately — block it at the perimeter and internally where not strictly required, particularly from untrusted or internet-facing segments.
  • Identify all TrueConf Server instances on your network and confirm whether port 4307/TCP is reachable from outside intended management or trusted zones.
  • Monitor TrueConf Server logs and network traffic on port 4307/TCP for unexpected connections or script execution activity.
  • Subscribe to TrueConf’s advisory for this CVE so you apply a fix as soon as one is published.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.8) across any TrueConf kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source