CISA Orders September Patches: Two Critical TrueConf Flaws…

CISA added two critical TrueConf Server vulnerabilities to the KEV catalog, already exploited by the Head Mare group to deploy PhantomCore malware. Federal agencies face hard deadlines: August 23 for CVE-2026-72529 and September 3 for CVE-2026-72530.

On August 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical flaws in TrueConf Server, an on-premises videoconferencing platform, to the Known Exploited Vulnerabilities (KEV) catalog. U.S. federal agencies must remediate them by non-negotiable deadlines: CVE-2026-72529 by August 23, 2026; CVE-2026-72530 by September 3, 2026. Both have already been exploited by the hacktivist group Head Mare to distribute the PhantomCore malware via trojanized client installers.

Key Takeaways

CVE-2026-72529 (CVSS 9.3, NVD) and CVE-2026-72530 (CVSS 9.5, SecurityAffairs) enable unauthenticated RCE on TrueConf Server via port 4307/TCP, followed by escape from the isolated sandbox.
Patches have been available since June 2026 in versions 5.3.9, 5.4.9, and 5.5.5; CISA set federal agency compliance deadlines at 3 days and 2 weeks from August 20, respectively.
The Head Mare group has exploited both vulnerabilities since at least July 2026, targeting Russian organizations in transportation, energy, IT, electronics, and software development.
The Kaspersky-documented attack follows a chain: web shell on the server, privileged database access, replacement of client installers, PhantomCore deployment, and persistent backdoor on *nix systems with C2 via the TrueConf protocol and GitHub.

The Attack Chain: From Port 4307 to Host System Control

The two vulnerabilities operate in sequence. CVE-2026-72529, classified by the National Vulnerability Database as CWE-306 (Missing Authentication for Critical Function), allows a remote unauthenticated attacker to invoke an undocumented function on TrueConf Server listening on port 4307/TCP and execute an arbitrary script. The attack vector is entirely network-based, requires no user interaction, and has low attack complexity per the CVSS 3.1 published by the NVD.

From this initial foothold, CVE-2026-72530 (CWE-94, Improper Control of Generation of Code) allows breaking out of the isolated sandbox in which the server operates. The NVD record for CVE-2026-72530 explicitly describes the ability for an attacker to "break out of the isolated environment and execute arbitrary code on the host system."

"A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server" — TrueConf security team, via BleepingComputer

Head Mare and PhantomCore: Tactics, Targets, and Confirmed Timeline

Kaspersky's analysis, cited by BleepingComputer and SecurityWeek, places the start of Head Mare's exploitation in July 2026. The group, described in sources as hacktivist and not financially motivated despite demanding ransoms, followed a documented operational pattern. After initial access to the TrueConf server, operators install a web shell used for internal reconnaissance, gain privileged access to the platform database, and replace legitimate client installers with malicious versions containing PhantomCore.

PhantomCore installs as a persistent backdoor on *nix systems running TrueConf Server. SecurityWeek reports the malware uses two distinct command-and-control channels: the native TrueConf protocol and infrastructure hosted on GitHub. This dual communication mode exploits protocols the victim organization considers trusted.

The role of Vyacheslav Kopeytsev, a Kaspersky ICS CERT researcher, in discovering the two vulnerabilities is documented by both SecurityAffairs and the official CVE.org record for CVE-2026-72529. Kaspersky provided both the analysis of the ongoing attack and the coordinated disclosure of the flaws.

Context: A Recurring Pattern of TrueConf Targeting

The CISA order comes five months after another significant incident on the same platform. In March–April 2026, Check Point Research documented "Operation True Chaos," an attack based on CVE-2026-3502 (CVSS 7.8, HIGH) attributed to a Chinese-origin threat actor. That attack, different in actors, techniques, and CVE identifier, shares the same target: on-premises TrueConf Server as an entry point into networks of organizations opting for self-hosted videoconferencing solutions.

The dual occurrence in 2026 — first by a Chinese actor, then by the hacktivist group Head Mare — indicates persistent and diverse interest in this platform. Sources do not document direct connections between the two episodes.

Analysis: Why Distribution via Compromised Clients Amplifies Risk

Replacing legitimate client installers with malicious versions represents an internal propagation technique that exploits pre-existing trust in binaries distributed by the organization's IT infrastructure. Unlike a payload requiring an external download, PhantomCore is installed through channels end users consider safe. This mechanism, documented by sources as part of Head Mare's chain, explains why CISA classified both CVEs with maximum urgency despite patches being available.

Immediate Actions

Verify exposure of port 4307/TCP: U.S. federal agencies must comply with BOD 22-01/26-04 deadlines; private organizations should treat the same urgency given confirmed in-the-wild exploitation.
Update to patched versions 5.3.9, 5.4.9, or 5.5.5: Fixes have been available since June 2026 and represent the only documented mitigation.
Monitor for affected TrueConf Server versions: Versions 5.3.x–5.3.9, 5.4.x–5.4.9, 5.5.x–5.5.5 and earlier are vulnerable.

Methodological note: NVD records for CVE-2026-72529 and CVE-2026-72530 do not list a publication date; temporal information derives from industry sources BleepingComputer, SecurityWeek, and SecurityAffairs. The CVSS 9.5 score for CVE-2026-72530 comes from SecurityAffairs, while the NVD has not yet assigned a final score as of the available sources.

Editorial Close

The August 20, 2026 CISA order confirms that two vulnerabilities patched since June remain actively exploited in-the-wild, with concrete operational consequences for federal agencies. The attack chain documented by Kaspersky — from initial server compromise to PhantomCore distribution via client installers — shows how on-premises platforms, while offering data control, demand timely application of security fixes. The Head Mare case joins "Operation True Chaos" as the second 2026 episode targeting TrueConf Server, with sources documenting no links between the two attacks.

Information verified against cited sources and current as of publication.

Sources

Sources and references