CVE-2026-72529

🗓️ 19 Aug 2026 16:55:14Reported by KasperskyType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 187 Views

Remote unauthenticated attacker exploits undocumented function in TrueConf Server 5.3-5.5.5 to run arbitrary scripts.

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the TrueConf Server software lies in the lack of authentication for critical functions, allowing attackers to execute arbitrary scripts and increase their privileges.	10 Aug 202600:00	–	bdu_fstec
Circl	CVE-2026-72529	10 Aug 202615:00	–	circl
CISA KEV Catalog	TrueConf Server Missing Authentication for Critical Function Vulnerability	20 Aug 202600:00	–	cisa_kev
Cvelist	CVE-2026-72529	19 Aug 202616:55	–	cvelist
EUVD	EUVD-2026-62587	19 Aug 202616:55	–	euvd
NVD	CVE-2026-72529	19 Aug 202617:21	–	nvd
Positive Technologies	PT-2026-70005	7 Aug 202600:00	–	ptsecurity
The Hacker News	TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore	10 Aug 202611:33	–	thn
VulnCheck KEV	VulnCheck KEV: CVE-2026-72529	12 Aug 202600:00	–	vulncheck_kev
Vulnrichment	CVE-2026-72529	19 Aug 202616:55	–	vulnrichment

NVD

Node

trueconf trueconf_serverRange<5.3.9.10013windows

trueconf trueconf_serverRange<5.3.9.10015linux_kernel

trueconf trueconf_serverRange5.4.0.12689–5.4.9.10072windows

trueconf trueconf_serverRange5.4.0.12700–5.4.9.10019linux_kernel

trueconf trueconf_serverRange5.5.0.13826–5.5.5.10010windows

trueconf trueconf_serverRange5.5.0.13828–5.5.5.10009linux_kernel

[
  {
    "vendor": "TrueConf",
    "product": "TrueConf Server",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThan": "5.3",
        "versionType": "custom"
      },
      {
        "version": "5.3",
        "status": "affected",
        "lessThan": "5.3.9",
        "versionType": "custom"
      },
      {
        "version": "5.4",
        "status": "affected",
        "lessThan": "5.4.9",
        "versionType": "custom"
      },
      {
        "version": "5.5",
        "status": "affected",
        "lessThan": "5.5.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
ics-cert	www.ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
securelist	www.securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/

21 Aug 2026 04:18Current

8.9High risk

Vulners AI Score8.9

CVSS 49.3

CVSS 3.19.8

EPSS0.01554

SSVC