TrueConf Server: Exploited Pre-Auth RCE Chain on Port 4307

What to do

1. Find every TrueConf Server instance and note its version and build.
2. Back up, then upgrade to 5.5.5, 5.4.9 or 5.3.9 or later; for 5.2 and older, contact TrueConf support.
3. Limit who can reach TCP 4307 to the networks and clients that need it.
4. Hunt for Kaspersky's indicators: a replaced locale.php, SysExcSvc/SysReadSvc services, a modified client installer, and deleted TrueConf event-log records.
5. If anything turns up, rebuild the server, rotate the passwords of every affected account, and check endpoints of users who installed a client from it.
6. Tell staff to install TrueConf clients only from the vendor, not from an update prompt shown by a third-party server.

How to check if you are affected or compromised

• Compare locale.php in the TrueConf web directory and the hosted trueconf_windows_client_x64.exe with clean vendor copies.
• On Windows servers, look for services SysExcSvc and SysReadSvc and files C:\Windows\System32\inetsrv\SysExcSvc.dll and SysReadSvc.dll; on Linux, omicluster.service and schedul2-bin.service.
• On clients, look for %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll and the InprocServer32 key under CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}.
• Check for gaps in TrueConf event logs and for connections to the IPs and domains in Kaspersky's Head Mare report.

What happened#

On June 18, 2026, TrueConf shipped TrueConf Server 5.3.9, 5.4.9 and 5.5.5 as an "important security update," urging customers to upgrade immediately but listing no CVEs. In August, Kaspersky ICS CERT published the two bugs behind it, and the reason for the urgency.

• CVE-2026-72529 (KLCERT-26-057, CWE-306): an unauthenticated attacker who can reach TCP port 4307 can "execute an arbitrary script by calling an undocumented function." CVSS 3.1 9.8.
• CVE-2026-72530 (KLCERT-26-058, CWE-94): that script runs in an isolated environment, and this flaw breaks out of it to execute code on the host. CVSS 3.1 9.0.

Kaspersky's threat report describes the Head Mare group chaining the two against Russian organizations. The attackers ran code as NT AUTHORITY\SYSTEM, replaced locale.php in the web directory with a web shell, and deleted the related TrueConf event-log records. They also installed backdoors that use OneDrive or GitHub for command and control. Finally, they swapped the Windows client installer the server hands out for a trojanized one. Participants who joined a conference were prompted to download a "new" client, which installed the real client plus the PhantomCore backdoor. Kaspersky warns that "even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers of contractors." CISA added both CVEs to KEV on August 20, 2026.

Who is affected#

All TrueConf Server versions before 5.3, plus 5.3.x before 5.3.9, 5.4.x before 5.4.9 and 5.5.x before 5.5.5, on Windows and Linux. Kaspersky says "all TrueConf server versions released since 2022 are vulnerable" and that port 4307 is open by default, per TrueConf's documentation. TrueConf's advisory page lists the fixed builds: 5.5.5.10010+ (Windows) / 10009+ (Linux), 5.4.9.10018+ / 10019+, and 5.3.9.10013+ / 10015+. Servers on 5.2 and below need TrueConf support to upgrade. The CVE-2026-72529 and CVE-2026-72530 records match these ranges.

Do you really need to act?#

For most readers, no. TrueConf Server is a self-hosted video-conferencing product, and the only documented victims so far are Russian organizations. If you do run it, though, this is as bad as it gets. The chain needs no credentials, reaches SYSTEM on the host, and is confirmed exploited (CVE-2026-72529 and CVE-2026-72530 in KEV). The attackers then used the server to infect its users. Any server that stayed unpatched and reachable on 4307 after mid-June should be investigated, not just upgraded. The second audience is easy to miss: companies whose employees join partners' TrueConf meetings and might accept a client "update" from a compromised server.

What to do now#

1. Find every TrueConf Server and record its version and build number from the admin panel.
2. Back up, then upgrade to 5.5.5, 5.4.9 or 5.3.9 (or a later supported release). TrueConf says upgrades within the 5.5, 5.4 and 5.3 lines do not require re-registration.
3. Restrict TCP 4307 at the firewall to the networks and clients that actually need it.
4. Hunt using Kaspersky's indicators (next section), and run a full antivirus scan with current definitions, as both advisories recommend.
5. If you find signs of compromise, rebuild the server, change the passwords of all potentially affected accounts, and check endpoints that downloaded a client from that server.
6. Tell staff to install TrueConf clients only from the vendor's site.

How to tell if you were hit#

Kaspersky lists a replaced locale.php web shell and a modified trueconf_windows_client_x64.exe on the server. On Windows hosts, look for the services SysExcSvc and SysReadSvc (C:\Windows\System32\inetsrv\SysExcSvc.dll, SysReadSvc.dll). On Linux, look for omicluster.service and schedul2-bin.service. On clients, check for %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll and a COM InprocServer32 key under CLSID {0340F119-A598-4ed9-B0AC-6F6A12D3E755}. Missing TrueConf event-log records are a signal in their own right. The report also includes MD5 hashes, five IP addresses, ten domains and YARA rules.

Timeline#

• Jun 18, 2026 — TrueConf releases Server 5.3.9, 5.4.9 and 5.5.5 as a security update.
• Aug 7, 2026 — Kaspersky ICS CERT advisories KLCERT-26-057 and -058 are dated (the pages are headed Aug 11).
• Aug 12, 2026 — Kaspersky publishes the Head Mare / PhantomCore report.
• Aug 19, 2026 — CVE-2026-72529 and CVE-2026-72530 are published.
• Aug 20, 2026 — CISA adds both to KEV (due Aug 23 and Sep 3).

Vulnerability records

• CVE-2026-72529 · KEV 2026-08-20 · A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
• CVE-2026-72530 · KEV 2026-08-20 · A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. TrueConf — Security fixes, updates and advisories trueconf.com
2. TrueConf — TrueConf Server security updates, June 2026 trueconf.com
3. Kaspersky ICS CERT — KLCERT-26-057: TrueConf Server. Missing authentication for critical function ics-cert.kaspersky.com
4. Kaspersky ICS CERT — KLCERT-26-058: TrueConf Server. Breakout from isolated environment ics-cert.kaspersky.com
5. CVE record — CVE-2026-72529 cve.org
6. CVE record — CVE-2026-72530 cve.org
7. CISA — Known Exploited Vulnerabilities: CVE-2026-72529 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-72530 cisa.gov
9. Kaspersky ICS CERT — Head Mare exploits vulnerabilities in TrueConf server to deliver PhantomCore malware ics-cert.kaspersky.com