The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal entities about the exploitation of two critical vulnerabilities within the TrueConf video conferencing platform. This notification, released on Thursday, highlights the urgent need for immediate patching to safeguard systems.
Details of the TrueConf Vulnerabilities
TrueConf, known for its secure on-premises video conferencing solutions, has been affected by significant security flaws since 2022. The vulnerabilities, identified as CVE-2026-72529 and CVE-2026-72530, present a high risk as they allow remote attackers to execute arbitrary code on the system.
The vulnerabilities can be accessed through port 4307/TCP, with CVE-2026-72529 enabling attackers to exploit an undocumented function to run arbitrary scripts. Meanwhile, CVE-2026-72530 allows attackers to breach the server’s isolated environment and execute commands on the host machine.
Urgent Patching and Exploitation Concerns
In response to these issues, TrueConf has released updates in June 2026, specifically in versions 5.3.9, 5.4.9, and 5.5.5, which address these vulnerabilities. CISA has now included these in its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the need for federal agencies to apply patches rapidly—within three days for one vulnerability and within two weeks for the other.
Although CISA has not disclosed detailed information on the exploitations, cybersecurity firm Kaspersky reports that the hacktivist group Head Mare has been leveraging these vulnerabilities. The group has been actively targeting entities in Russia and Belarus since 2023, deploying a malware known as PhantomCore.
Impact and Recommendations for TrueConf Users
Head Mare’s attacks involve compromising the TrueConf server, replacing files with malicious web shells, and gaining access to sensitive IT infrastructure. The intrusions often lead to the installation of the PhantomCore malware on employee devices, alongside backdoors on systems running TrueConf protocols.
TrueConf server operators are advised to update to the latest patched versions, thoroughly scan their systems for indicators of compromise and malicious artifacts, and change credentials for potentially affected accounts. Proactive measures are crucial to mitigate the risks posed by these vulnerabilities.
This incident underscores the importance of regular updates and vigilant cybersecurity practices to protect critical infrastructure from evolving threats.
