MSRXTrueConf vulnerabilities being exploited
3 TrueConf flaws were confirmed exploited in the wild in the past 365 days, across 2 products: Client, Server. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-08-20 | CVE-2026-72530 Server TrueConf Server Code Injection Vulnerability TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. | 2026-09-03 |
| 2026-08-20 | CVE-2026-72529 Server TrueConf Server Missing Authentication for Critical Function Vulnerability TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. | 2026-08-23 |
| 2026-04-02 | CVE-2026-3502 Client TrueConf Client Download of Code Without Integrity Check Vulnerability TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user. | 2026-04-16 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.