TrueConf Client CVE-2026-3502: Unverified Update Hijack

What to do

1. Inventory TrueConf clients and update every install below 8.5.3.884, preferably to the current release.
2. On each TrueConf Server, replace the hosted client installers with current vendor builds and update the client version settings in the control panel.
3. Patch and harden TrueConf Server itself, since this attack starts with control of the server.
4. Confirm the installers your server hands out are signed by TrueConf and match the vendor's downloads.
5. Tell staff to distrust unexpected TrueConf update prompts, especially after clicking a meeting link, and to install clients only from trueconf.com.

How to check if you are affected or compromised

• Check whether trueconf_windows_update.exe on clients is unsigned, and hunt for trueconf.exe launching trueconf_windows_update.exe, then trueconf_windows_update.tmp, then another executable.
• Treat machines with C:\ProgramData\PowerISO\poweriso.exe or 7z-x64.dll, or an HKCU Run value named UpdateCheck pointing to it, as infected.
• Look for %AppData%\Roaming\Adobe\update.7z, 7za.exe, iscsiexe.dll or rom.dat, and for poweriso.exe spawning cmd.exe with curl, winrar.exe or netstat.
• Search network logs for 43.134.90[.]60, 43.134.52[.]221 and 47.237.15[.]197, which Check Point lists as Havoc C2.

What happened#

On March 30, 2026, Check Point, acting as CNA, published CVE-2026-3502. The record says TrueConf Client "downloads application update code and applies it without performing verification." When the client starts, it asks its TrueConf server whether a newer client version exists. If one does, the client prompts the user to download it from that server. Nothing checks that the file really came from TrueConf.

The next day, Check Point Research described how attackers used the flaw in a campaign it calls TrueChaos. In attacks Check Point observed from early 2026, the attackers controlled an on-premises TrueConf Server run by a government IT department in Southeast Asia, which served dozens of government entities. They replaced the update package on that server. The weaponized "update" genuinely upgraded clients from 8.5.1 to 8.5.2. It also dropped poweriso.exe and a malicious 7z-x64.dll into C:\ProgramData\PowerISO\, where the DLL was loaded by sideloading. Hands-on activity followed, including a UAC bypass through iscsicpl.exe and traffic to Havoc C2 servers. Check Point attributes the campaign, with moderate confidence, to a Chinese-nexus actor. It also saw ShadowPad on the same victim in the same period. CISA added the CVE to KEV on April 2, with an April 16 deadline.

Who is affected#

TrueConf Client 8.1.0 through 8.5.2 is affected. TrueConf's advisory table lists the fix as 8.5.3.884 or later and scores the flaw CVSS 3.1 7.8 (adjacent network, high privileges, user interaction). NVD carries the same score. Check Point says the fix shipped in 8.5.3 in March. TrueConf's 8.5.3 post is dated April 1 and does not mention security. The current Windows client on the vendor's download page is 8.5.5.173.

This is the client-side half of a pattern we covered in the Head Mare brief. There, server flaws let attackers take over TrueConf servers and swap the client installer that the server hands to meeting participants.

Do you really need to act?#

Most organizations do not use TrueConf, and they can skip this. For those that do, the 7.8 score understates the blast radius. The bug is not the way in, because the attacker first needs control of the server. But it turns one server compromise into code execution on every connected client. In 2026, TrueConf servers have already been taken over through exploited server bugs, so clients still on 8.5.2 or older are a real liability. That includes staff who join partners' meetings.

What to do now#

1. Inventory clients: Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like 'TrueConf*' | Select-Object DisplayName, DisplayVersion. Push 8.5.3.884 or later to every install.
2. On each server, follow TrueConf's client update procedure. Rename current vendor builds to trueconf_windows_client_x64.exe and trueconf_windows_client_x86.exe, place them in ClientInstFiles (Windows) or /opt/trueconf/server/srv/clients/ (Linux), and set the current version in the control panel.
3. Check that the hosted installers are signed by TrueConf: Get-AuthenticodeSignature 'C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe'.
4. Patch the server itself. TrueConf's current release is 5.5.8, from October 22, 2026.
5. Tell staff to distrust update prompts that appear after clicking a meeting link.

How to tell if you were hit#

Check Point's hunting guidance: an unsigned trueconf_windows_update.exe, and the process chain trueconf.exe to trueconf_windows_update.exe to trueconf_windows_update.tmp to any other executable. Treat a machine as infected if it has C:\ProgramData\PowerISO\poweriso.exe, or a HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UpdateCheck value pointing to it. Other signs are %AppData%\Roaming\Adobe\update.7z, iscsiexe.dll or rom.dat, and poweriso.exe spawning cmd.exe with curl or WinRAR. Search network logs for 43.134.90[.]60, 43.134.52[.]221 and 47.237.15[.]197.

Timeline#

• Mar 30, 2026 — CVE-2026-3502 is published.
• Mar 31, 2026 — Check Point publishes its TrueChaos report.
• Apr 1, 2026 — TrueConf posts the 8.5.3 client release.
• Apr 2, 2026 — CISA adds the CVE to KEV, with an April 16 deadline.

Vulnerability records

• CVE-2026-3502 · KEV 2026-04-02 · TrueConf Client downloads application update code and applies it without performing verification.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. TrueConf — Security Vulnerabilities, Fixes and Advisories trueconf.com
2. TrueConf — TrueConf 8.5.3 release trueconf.com
3. TrueConf — TrueConf 8.5 for Windows, macOS and Linux trueconf.com
4. TrueConf — Download TrueConf for Windows trueconf.com
5. TrueConf — Server administrator documentation: updating client applications trueconf.com
6. CVE record — CVE-2026-3502 cve.org
7. NVD — CVE-2026-3502 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-3502 cisa.gov
9. Check Point Research — Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets research.checkpoint.com