CISA flags TrueConf Server auth and code injection flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA adds two actively exploited TrueConf Server vulnerabilities to KEV catalog; federal agencies must prioritize patches.
CISA has added two vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CVE-2026-72529 is a missing authentication flaw in a critical function that could allow unauthenticated attackers to gain unauthorized access. CVE-2026-72530 is a code injection vulnerability that enables attackers to execute arbitrary code on affected systems. Both flaws grant total control of the affected asset post-exploitation.
Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize rapid remediation of these high-risk vulnerabilities on publicly exposed assets. CISA encourages all organizations to adopt risk-based vulnerability management and treat KEV Catalog entries as priority patches. Organizations should immediately check whether TrueConf Server instances were compromised before patches were applied, given the severity of post-exploitation impact and confirmed active exploitation.
Mentioned in this report
Detection guidance
TrueConf Server Process Spawning PowerShell or Command Shell
A TrueConf Server process spawning PowerShell, pwsh or cmd.exe, which would be consistent with code injection or auth-bypass exploitation leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TrueConf Server Process Spawning PowerShell or Command Shell
description: Detects a TrueConf Server process spawning powershell, pwsh or cmd. The
report describes exploitation of TrueConf Server (missing authentication plus code
injection) giving arbitrary code execution, and a conferencing server has little
reason to launch interactive shells. Matches on the parent/child relation, not on
specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: TrueConf
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
condition: selection
falsepositives:
- Administrators running maintenance or upgrade scripts that the TrueConf service
launches
- Vendor installer or updater helper scripts invoking cmd.exe
level: high
id: 538c9f33-83c1-5f99-8341-0418ac3ec34d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
TrueConf Server Process Spawning Download or Recon LOLBins
A TrueConf Server process launching living-off-the-land binaries commonly used for payload download and host recon after exploiting a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TrueConf Server Process Spawning Download or Recon LOLBins
description: Detects a TrueConf Server process spawning utilities typically used for
post-exploitation payload retrieval, execution or host discovery (certutil, bitsadmin,
mshta, rundll32, regsvr32, curl, whoami, net, systeminfo). Intended to catch follow-on
activity after exploitation of the TrueConf Server auth bypass or code injection
flaws.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: TrueConf
Image|endswith:
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \curl.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \systeminfo.exe
condition: selection
falsepositives:
- Vendor installer or updater components calling rundll32.exe or regsvr32.exe during
upgrades
- Administrator troubleshooting via scripts started from the TrueConf service
level: high
id: 9f201ab7-4428-5321-bbfa-d718f99c6c5c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
TrueConf Server Process Spawning Shell on Linux
A TrueConf Server process on Linux spawning a shell, suggesting command execution through exploitation of the server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TrueConf Server Process Spawning Shell on Linux
description: Detects a TrueConf Server process on Linux spawning sh, bash or dash,
which would be consistent with exploitation of the code injection or missing authentication
flaws leading to arbitrary command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: trueconf
Image|endswith:
- /sh
- /bash
- /dash
condition: selection
falsepositives:
- Service start or init wrapper scripts launched by the TrueConf package
- Package post-install or upgrade scripts
level: medium
id: 6eee3ad2-dfe8-5432-9ea3-969a335a4714
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs