THREATOPS

THREAT OPS › CVEs › CVE-2026-72530

CVE-2026-72530 — TrueConf Server Code Injection Vulnerability

CISA KEVExploited: confirmedTrueConf

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Vulnerability details

Affected productsServer
KEV remediation due2026-09-03

Related reporting

August 2026 CVE Landscaperecordedfuture
TrueConf security advisory (AV26-835)cccs_ca
CISA Adds Two Known Exploited Vulnerabilities to Catalogcisa_advisories
[CISA KEV] CVE-2026-72530 — TrueConf Server: TrueConf Server Code Injection Vulnerabilitycisa_kev