The US cybersecurity agency CISA on Thursday warned federal agencies that threat actors have been exploiting two vulnerabilities in TrueConf.
A secure on-premises video conferencing platform, TrueConf relies on Scalable Video Coding (SVC) to connect client applications through a dedicated corporate server.
All TrueConf Server versions since 2022 contain two critical-severity bugs tracked as CVE-2026-72529 and CVE-2026-72530 that allow attackers to execute arbitrary code.
The two vulnerabilities can be exploited by remote attackers with access to the TrueConf server via port 4307/TCP. CVE-2026-72529 allows the attacker to call an undocumented function and execute arbitrary scripts, while CVE-2026-72530 enables them to escape the isolated environment and execute scripts on the host system.
The exploited vulnerabilities were addressed in June 2026, in TrueConf Server versions 5.3.9, 5.4.9 and 5.5.5.
On Thursday, CISA added both to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch the former within three days and the latter within two weeks.
While CISA has not shared details on the observed exploitation, earlier this month Kaspersky warned that they have been exploited by the hacktivist group Head Mare to deploy the PhantomCore malware.