Critical Remote Code Execution & Sandbox Escape Flaws in TrueConf Server Added to CISA KEV Catalog
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed two high‑severity vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog:
- CVE‑2026‑72529 – Missing authentication for a critical function, CVSS 9.3, allows an unauthenticated attacker on TCP 4307 to execute arbitrary scripts.
- CVE‑2026‑72530 – Code‑injection sandbox‑escape, CVSS 9.5, lets an unauthenticated attacker break out of the TrueConf sandbox and run code on the host.
Both affect TrueConf Server 5.3.x through 5.5.5 (and earlier releases) deployed on‑premises.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.2 (Vulnerability Management) requires timely identification, remediation, and documented evidence of critical flaws; these CVEs trigger an immediate control‑failure risk.
- Continuous‑control monitoring and evidence collection (the focus of Verisq’s Control Mapping capability) become essential to prove that remediation actions were taken before an audit.
- Failure to patch or mitigate can break the defensible audit trail for system security and jeopardize the “Security” principle of SOC 2.
Who Is Affected – Enterprises, government agencies, educational institutions, and any organization that runs TrueConf Server on‑premises for video‑conferencing and unified communications.
Recommended Actions
- Inventory every TrueConf Server instance and record the exact version.
- Apply the vendor‑released patches or upgrade to a non‑vulnerable release immediately.
- Block inbound traffic to TCP 4307 at the network perimeter if the service is not required.
- Capture remediation steps (ticket IDs, patch files, configuration changes) in your SOC 2 evidence repository.
- Integrate the vulnerability into your continuous‑monitoring pipeline to generate audit‑ready reports.
Source: Security Affairs
Technical Notes – Both flaws are unauthenticated remote‑code‑execution vectors that require network access to TCP 4307. CVE‑2026‑72529 exploits a missing authentication check; CVE‑2026‑72530 leverages a sandbox‑escape via crafted script injection. No public exploits were disclosed prior to the KEV listing, but the high CVSS scores indicate a strong likelihood of active exploitation.