1. Executive summary
CVE-2026-72530 is a CVSS 9.5 CRITICAL CWE-94 code-injection vulnerability affecting TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier. An unauthorised remote attacker with network access to 4307/TCP could submit a specially crafted script, escape the product’s isolated environment and execute arbitrary code on the host. Authoritative reference data records the vulnerability as NOT in CISA KEV, with EPSS 0%; no confirmed exploitation, malware deployment or victim impact is established. This conflicts with the NVD change history, which shows a CISA KEV reference and a CISA SSVC change to “active” exploitation; clients should use the authoritative state for this advisory but verify the live catalogue before enforcement.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. No item-specific trigger for UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties is established by the supplied facts.
3. Technical analysis & attack chain
Authoritative status: CVSS 9.5 CRITICAL — NOT in CISA KEV — EPSS 0% — CWE-94 (Code Injection). The NVD change history conflicts with the verified KEV state by recording an added KEV reference and CISA SSVC “active” exploitation on 20 August 2026; the verified reference controls this advisory.
Source-supported exploit path—not a confirmed observed intrusion:
- An unauthorised remote attacker obtains network reachability to an affected TrueConf Server over 4307/TCP.
- The attacker submits a specially crafted script to the server. The supplied CVSS vectors indicate network access, no prior privileges and no user interaction, but high attack complexity.
- The script breaks out of the product’s isolated environment.
- Attacker-controlled code executes on the underlying host. The execution context and resulting operating-system privileges are not specified.
Technical scope
| Area | Source-supported detail |
|---|---|
| Affected product | TrueConf Server |
| Affected versions | 5.3.X to 5.3.9; 5.4.X to 5.4.9; 5.5.X to 5.5.5; and earlier |
| Network vector | 4307/TCP |
| Weakness | CWE-94: Improper Control of Generation of Code (“Code Injection”) |
| CVSS | Authoritative score: 9.5 CRITICAL |
| Supplied CVSS v3.1 vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Supplied CVSS v4.0 vector | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Authentication | Described as an unauthorised remote attack; the supplied vectors specify PR:N |
| Payload | Arbitrary attacker-selected code; no payload or exploit sample supplied |
| Execution privileges | Not specified; do not assume root, SYSTEM or service-account privileges |
| Persistence | Not described |
| Privilege escalation | Not described |
| Command-and-control | Not described |
| Lateral movement | Not described |
| Data access or exfiltration | No observed access or exfiltration reported |
| Impact | Potential host confidentiality, integrity and availability impact; no observed victim impact supplied |
| Ransomware | Campaign use is stated as unknown, not confirmed |
NVD identifies Kaspersky Labs as the source of the CVE record and links to a Securelist page whose title names “Head Mare” and “PhantomCore.” The underlying report content and supporting telemetry were not supplied, and the verified data contains no MITRE profile for Head Mare. Any actor or malware attribution is therefore unconfirmed and single-sourced; verify before enforcement.
4. Mitigation & containment
| Priority | Required action |
|---|---|
| P1 — within 24 hours | Inventory TrueConf Server deployments and identify all installations in the affected version ranges. Confirm whether each host is listening on 4307/TCP and whether that port is reachable from the internet, user networks, partner connections or other untrusted segments. |
| P1 — within 24 hours | Deny inbound 4307/TCP at perimeter firewalls, security groups and internal segmentation controls except from explicitly authorised source ranges. If access cannot be tightly restricted, isolate the server or disable the service until remediation is available. |
| P1 — within 24 hours | If suspicious access or host execution is identified, isolate the system while preserving TrueConf, operating-system, firewall, network-flow and EDR telemetry. Treat arbitrary host execution as a potential full-host compromise and rotate credentials only after determining which secrets were accessible from that host. |
| P2 — within 72 hours | Obtain and apply the current vendor mitigation or a vendor-confirmed non-affected release. No fixed version, patch identifier or vendor command is supplied; do not infer that the next numerical release is safe. If no effective mitigation is available, discontinue use of the affected deployment. |
| P2 — within 72 hours | After remediation, confirm the installed version, retest 4307/TCP reachability from each relevant trust zone and verify that unauthorised sources cannot establish sessions. |
| P2 — within 72 hours | Retrospectively hunt network telemetry for connections to affected hosts on destination port 4307 and correlate them with unexpected host-code execution or security-control alerts. The source supplies no exploit signature, process name or payload, so results require manual validation. |
| P3 — within 7 days | Place TrueConf servers in a dedicated network segment, restrict administrative and service access to required sources, and add exposure monitoring for changes affecting 4307/TCP. Record any remediation exception with an owner and expiry date. |
No source-supplied command, firewall syntax, file path, registry key, service name or fixed build is available. The primary item includes KEV-oriented remediation language, but the authoritative reference states NOT in CISA KEV and supplies no KEV remediation deadline; no deadline is asserted here.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Network access to an affected TrueConf Server over destination port 4307/TCP | Firewall, network-flow, packet-capture and host network-connection telemetry | Medium: vulnerability prerequisite, not proof of exploitation; single-sourced; verify before enforcement |
| Delivery of a specially crafted script followed by escape from the isolated environment and arbitrary host-code execution | TrueConf application logs, operating-system audit data and EDR telemetry correlated with 4307/TCP sessions | Medium: source-described mechanism, but no request pattern, process name or event identifier is available; single-sourced; verify before enforcement |
6. Detection
No YARA rule is supportable: the source provides no malicious-file strings, command-line flags, mutexes, filenames, paths, registry keys, service names or hard-coded payload values.
The following low-fidelity Sigma hunt identifies network connections to the affected service port. Scope it to confirmed TrueConf Server assets; a match alone is not evidence of exploitation.
title: Network Connection to TCP 4307 on an Affected TrueConf Server
status: experimental
description: Identifies network connections to the TrueConf Server port used in the CVE-2026-72530 attack path.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-72530
author: Adverse Trace
date: 2026-08-20
logsource:
category: network_connection
detection:
selection:
DestinationPort: 4307
condition: selection
Prioritise connections from unapproved trust zones and correlate them with execution telemetry on the destination host. No source-supplied byte pattern or request structure is available to distinguish a crafted script from legitimate 4307/TCP traffic.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-72530 | 9.5 Critical | — | 0% | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5… |
7. Sources
- NIST National Vulnerability Database, “CVE-2026-72530 Detail”, published 19 August 2026; change history updated 20 August 2026.
- Kaspersky Securelist, “Head Mare targets TrueConf Server with PhantomCore”, date not supplied in the provided material; referenced by NVD, but underlying report content was not provided.
8. Adverse Trace position
Adverse Trace retains the authoritative classification of CVSS 9.5 CRITICAL, NOT in CISA KEV, EPSS 0% and CWE-94. Affected, network-reachable TrueConf Server installations present material host-compromise risk, but the supplied evidence does not establish exploitation, victim impact, ransomware use or a confirmed threat actor; any Head Mare or PhantomCore linkage is unconfirmed, lacks a supplied MITRE profile and is single-sourced; verify before enforcement. We will monitor for reconciliation of the KEV discrepancy, vendor-confirmed fixed versions, exploitation evidence and actionable indicators.
Published via PulseTrace — Adverse Trace threat intelligence.