Federal KEV Addition & Supply Chain Exploit: CISA Adds Two Actively Exploited TrueConf Server Vulnerabilities to KEV Catalog (CVE-2026-72529 & CVE-2026-72530)
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog on August 20–21, 2026, adding two critical security vulnerabilities in TrueConf Server (CVE-2026-72529 and CVE-2026-72530) based on evidence of active, in-the-wild exploitation. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate these flaws immediately. The vulnerabilities allow unauthenticated remote attackers to achieve full system execution on video conferencing servers and have been actively weaponized in the wild to trojanize client application packages with the PhantomCore and PhantomGraph backdoors.
Technical Breakdown of the TrueConf Server Exploit Chain
The two flaws function as a seamless remote-to-root attack chain targeting TrueConf video conferencing infrastructure:
1. Authentication Bypass & Sandbox Escape Code Injection
The vulnerability chain enables full operating system takeover via external network access:
* Missing Authentication (CVE-2026-72529): An unauthenticated remote attacker connecting via TCP port 4307 can invoke critical server management functions and execute arbitrary operational scripts.
* Code Injection & Sandbox Escape (CVE-2026-72530): Attackers inject malicious parameters that escape the isolated execution environment, obtaining code execution with full NT AUTHORITY\SYSTEM administrative privileges.
2. Supply Chain Trojanization & Backdoor Delivery
Threat actors (tracked as Head Mare) weaponized compromised TrueConf servers into internal software distribution vectors:
* Web Shell Persistence: Intruders dropped persistent PHP web shells (e.g., modifying ...\public\js\locale.php) and established reverse SSH tunnels.
* Trojanized Client Distributions: Attackers replaced the legitimate TrueConf Client installer hosted on the server with an unsigned, trojanized binary embedding the PhantomCore RAT and PhantomGraph modules (SysExcSvc.dll, SysReadSvc.dll) to compromise client workstations joining video meetings.
Vulnerability Overview Table
Category
Details
Target Software
TrueConf Server (Enterprise Video Conferencing Platform)
Vulnerability Identifiers
CVE-2026-72529 & CVE-2026-72530
CVSS v3.1 Scores
9.8 (Critical) & 9.8 (Critical)
Governing Mandate
CISA Binding Operational Directive (BOD) 26-04
Remediation Versions
TrueConf Server 5.3.9, 5.4.9, 5.5.5 or later
Observed Malware Strains
PhantomCore Backdoor, PhantomGraph DLL Modules
Enterprise Unified Communications as a Software Distribution Vector
Video conferencing and unified communications (UC) platforms represent high-trust nodes within enterprise environments. When an adversary compromises an internal communications server, they gain not only access to sensitive corporate meetings and chat logs, but also the ability to leverage trusted software update channels to distribute signed or unsigned malware directly to employee endpoints.
Enterprise defenders must treat patching as only the first step, conducting thorough forensic log reviews to ensure compromised servers have not been leveraged for downstream malware distribution.
Recommendations and Mitigations
TrueConf administrators, UC engineers, and IT security teams should execute immediate defensive procedures:
1. Upgrade TrueConf Server to Fixed Builds Immediately: Deploy TrueConf Server version 5.3.9, 5.4.9, 5.5.5, or the latest supported branch release to eliminate the vulnerability chain.
2. Restrict TCP Port 4307 Exposure: Restrict access to TrueConf Server management ports (TCP 4307) exclusively to trusted internal administrative subnets.
3. Audit Hosted Client Installer Packages: Verify the digital signature of TrueConf Client installer binaries hosted on the server; ensure the cryptographic signature is valid and matches TrueConf.
4. Conduct Thorough Server & Endpoint Forensic Hunting: Inspect TrueConf web root directories for rogue PHP scripts (locale.php), check for suspicious services (SysExcSvc.dll), and inspect LSASS process access logs.