---
title: "TrueConf Client CVE-2026-3502: Unverified Update Hijack"
url: https://erroneo.us/security/briefs/trueconf-client-cve-2026-3502-update-hijack-truechaos/
description: "TrueConf Client 8.1.0-8.5.2 runs server-pushed updates unverified; exploited in Operation TrueChaos. Fixed in 8.5.3.884. Update clients if you use TrueConf."
type: security-brief
section: "Security Digest"
date_published: 2026-03-30
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-3502"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# TrueConf Client CVE-2026-3502: Unverified Update Hijack

**Verdict: Check exposure.** Only organizations whose staff run TrueConf clients are exposed; for them, moving every client to 8.5.3.884 or later matters, because one compromised TrueConf server can otherwise push malware to all of its users.

- **Who must act:** Organizations that run TrueConf Server on premises, or whose staff use TrueConf Client 8.1.0 through 8.5.2, including to join meetings on partners' or contractors' servers.
- **Who can relax:** Organizations with no TrueConf clients or servers; the flaw only matters for clients that take updates from a TrueConf server.
- **Affected:** TrueConf Client 8.1.0 through 8.5.2
- **Fixed:** TrueConf Client 8.5.3.884 or later; Current Windows client: 8.5.5.173 (8.5.5.187 for the legacy Windows 7 build)
- **CVEs:** CVE-2026-3502
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory TrueConf clients and update every install below 8.5.3.884, preferably to the current release.
2. On each TrueConf Server, replace the hosted client installers with current vendor builds and update the client version settings in the control panel.
3. Patch and harden TrueConf Server itself, since this attack starts with control of the server.
4. Confirm the installers your server hands out are signed by TrueConf and match the vendor's downloads.
5. Tell staff to distrust unexpected TrueConf update prompts, especially after clicking a meeting link, and to install clients only from trueconf.com.

### How to check if you are affected

- Check whether trueconf_windows_update.exe on clients is unsigned, and hunt for trueconf.exe launching trueconf_windows_update.exe, then trueconf_windows_update.tmp, then another executable.
- Treat machines with C:\ProgramData\PowerISO\poweriso.exe or 7z-x64.dll, or an HKCU Run value named UpdateCheck pointing to it, as infected.
- Look for %AppData%\Roaming\Adobe\update.7z, 7za.exe, iscsiexe.dll or rom.dat, and for poweriso.exe spawning cmd.exe with curl, winrar.exe or netstat.
- Search network logs for 43.134.90[.]60, 43.134.52[.]221 and 47.237.15[.]197, which Check Point lists as Havoc C2.

## What happened

On March 30, 2026, Check Point, acting as CNA, published [CVE-2026-3502](https://www.cve.org/CVERecord?id=CVE-2026-3502). The record says TrueConf Client "downloads application update code and applies it without performing verification." When the client starts, it asks its TrueConf server whether a newer client version exists. If one does, the client prompts the user to download it from that server. Nothing checks that the file really came from TrueConf.

The next day, [Check Point Research](https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/) described how attackers used the flaw in a campaign it calls TrueChaos. In attacks Check Point observed from early 2026, the attackers controlled an on-premises TrueConf Server run by a government IT department in Southeast Asia, which served dozens of government entities. They replaced the update package on that server. The weaponized "update" genuinely upgraded clients from 8.5.1 to 8.5.2. It also dropped `poweriso.exe` and a malicious `7z-x64.dll` into `C:\ProgramData\PowerISO\`, where the DLL was loaded by sideloading. Hands-on activity followed, including a UAC bypass through `iscsicpl.exe` and traffic to Havoc C2 servers. Check Point attributes the campaign, with moderate confidence, to a Chinese-nexus actor. It also saw ShadowPad on the same victim in the same period. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502) on April 2, with an April 16 deadline.

## Who is affected

TrueConf Client 8.1.0 through 8.5.2 is affected. TrueConf's [advisory table](https://trueconf.com/blog/news/security-fixes-updates-and-advisories) lists the fix as 8.5.3.884 or later and scores the flaw CVSS 3.1 7.8 (adjacent network, high privileges, user interaction). [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3502) carries the same score. Check Point says the fix shipped in 8.5.3 in March. TrueConf's [8.5.3 post](https://trueconf.com/blog/update/trueconf-8-5-3) is dated April 1 and does not mention security. The current Windows client on the vendor's [download page](https://trueconf.com/downloads/windows.html) is 8.5.5.173.

This is the client-side half of a pattern we covered in the [Head Mare brief](https://erroneo.us/security/briefs/trueconf-server-cve-2026-72529-72530-head-mare/). There, server flaws let attackers take over TrueConf servers and swap the client installer that the server hands to meeting participants.

## Do you really need to act?

Most organizations do not use TrueConf, and they can skip this. For those that do, the 7.8 score understates the blast radius. The bug is not the way in, because the attacker first needs control of the server. But it turns one server compromise into code execution on every connected client. In 2026, TrueConf servers have already been taken over through exploited server bugs, so clients still on 8.5.2 or older are a real liability. That includes staff who join partners' meetings.

## What to do now

1. Inventory clients: `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like 'TrueConf*' | Select-Object DisplayName, DisplayVersion`. Push 8.5.3.884 or later to every install.
2. On each server, follow TrueConf's [client update procedure](https://trueconf.com/docs/server/en/admin/info/). Rename current vendor builds to `trueconf_windows_client_x64.exe` and `trueconf_windows_client_x86.exe`, place them in `ClientInstFiles` (Windows) or `/opt/trueconf/server/srv/clients/` (Linux), and set the current version in the control panel.
3. Check that the hosted installers are signed by TrueConf: `Get-AuthenticodeSignature 'C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe'`.
4. Patch the server itself. TrueConf's current release is 5.5.8, from October 22, 2026.
5. Tell staff to distrust update prompts that appear after clicking a meeting link.

## How to tell if you were hit

Check Point's hunting guidance: an unsigned `trueconf_windows_update.exe`, and the process chain `trueconf.exe` to `trueconf_windows_update.exe` to `trueconf_windows_update.tmp` to any other executable. Treat a machine as infected if it has `C:\ProgramData\PowerISO\poweriso.exe`, or a `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UpdateCheck` value pointing to it. Other signs are `%AppData%\Roaming\Adobe\update.7z`, `iscsiexe.dll` or `rom.dat`, and `poweriso.exe` spawning `cmd.exe` with curl or WinRAR. Search network logs for `43.134.90[.]60`, `43.134.52[.]221` and `47.237.15[.]197`.

## Timeline

- Mar 30, 2026 — CVE-2026-3502 is published.
- Mar 31, 2026 — Check Point publishes its TrueChaos report.
- Apr 1, 2026 — TrueConf posts the 8.5.3 client release.
- Apr 2, 2026 — CISA adds the CVE to KEV, with an April 16 deadline.

## Sources

1. [TrueConf — Security Vulnerabilities, Fixes and Advisories](https://trueconf.com/blog/news/security-fixes-updates-and-advisories)
2. [TrueConf — TrueConf 8.5.3 release](https://trueconf.com/blog/update/trueconf-8-5-3)
3. [TrueConf — TrueConf 8.5 for Windows, macOS and Linux](https://trueconf.com/blog/update/trueconf-8-5)
4. [TrueConf — Download TrueConf for Windows](https://trueconf.com/downloads/windows.html)
5. [TrueConf — Server administrator documentation: updating client applications](https://trueconf.com/docs/server/en/admin/info/)
6. [CVE record — CVE-2026-3502](https://www.cve.org/CVERecord?id=CVE-2026-3502)
7. [NVD — CVE-2026-3502](https://nvd.nist.gov/vuln/detail/CVE-2026-3502)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-3502](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502)
9. [Check Point Research — Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets](https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/)

---
Source page: https://erroneo.us/security/briefs/trueconf-client-cve-2026-3502-update-hijack-truechaos/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt