The US cybersecurity agency CISA on Thursday warned federal agencies that threat actors have been exploiting two vulnerabilities in TrueConf.
A secure on-premises video conferencing platform, TrueConf relies on Scalable Video Coding (SVC) to connect client applications through a dedicated corporate server.
All TrueConf Server versions since 2022 contain two critical-severity bugs tracked as CVE-2026-72529 and CVE-2026-72530 that allow attackers to execute arbitrary code.
The two vulnerabilities can be exploited by remote attackers with access to the TrueConf server via port 4307/TCP. CVE-2026-72529 allows the attacker to call an undocumented function and execute arbitrary scripts, while CVE-2026-72530 enables them to escape the isolated environment and execute scripts on the host system.
The exploited vulnerabilities were addressed in June 2026, in TrueConf Server versions 5.3.9, 5.4.9 and 5.5.5.
On Thursday, CISA added both to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch the former within three days and the latter within two weeks.
While CISA has not shared details on the observed exploitation, earlier this month Kaspersky warned that they have been exploited by the hacktivist group Head Mare to deploy the PhantomCore malware.
Active since at least 2023, Head Mare has been targeting organizations in Russia and Belarus in destructive attacks. It has been observed deploying file-encrypting malware and demanding ransom payments from its victims, but the group does not appear to be financially motivated.
As part of the attacks investigated by Kaspersky, the hackers exploited CVE-2026-72529 and CVE-2026-72530 to compromise an organization’s TrueConf server and replace one of its files with a web shell.
“This web shell is later used to gather information about the IT infrastructure of the attacked organization, gain privileged access to the TrueConf Server database, and replace the legitimate client installers,” Kaspersky says.
The threat actors placed malicious TrueConf client installers on the server. Once executed on the employee’s systems, they installed PhantomCore, a piece of malware typically associated with Head Mare’s intrusions.
Additionally, the attackers installed a backdoor on the nix servers running TrueConf, and another on nix systems. The former uses the TrueConf protocol for command-and-control (C&C) communication, while the latter uses GitHub.
TrueConf server owners are advised to update to a patched version, scan their environments for indicators of compromise (IoCs), scan for malicious artifacts, and rotate the credentials for all potentially affected accounts if an intrusion is detected.
Related: Hackers Target Zimbra Servers in Active Exploitation Campaign
Related: Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities
Related: MLflow Vulnerability Exploited for Cloud Credential Theft
Related: Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities