# CISA flags TrueConf Server auth and code injection flaws

Published: 2026-08-20 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/3adfc8a4-68fe-570d-88c8-92751a83176b/cisa-flags-trueconf-server-auth-and-code-injection-flaws

> CISA adds two actively exploited TrueConf Server vulnerabilities to KEV catalog; federal agencies must prioritize patches.

CISA has added two vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CVE-2026-72529 is a missing authentication flaw in a critical function that could allow unauthenticated attackers to gain unauthorized access. CVE-2026-72530 is a code injection vulnerability that enables attackers to execute arbitrary code on affected systems. Both flaws grant total control of the affected asset post-exploitation.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize rapid remediation of these high-risk vulnerabilities on publicly exposed assets. CISA encourages all organizations to adopt risk-based vulnerability management and treat KEV Catalog entries as priority patches. Organizations should immediately check whether TrueConf Server instances were compromised before patches were applied, given the severity of post-exploitation impact and confirmed active exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-72529 (KEV), CVE-2026-72530 (KEV)

## Detection guidance (public sample)

### TrueConf Server Process Spawning PowerShell or Command Shell

ATT&CK: T1059.001

A TrueConf Server process spawning PowerShell, pwsh or cmd.exe, which would be consistent with code injection or auth-bypass exploitation leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: TrueConf Server Process Spawning PowerShell or Command Shell
description: Detects a TrueConf Server process spawning powershell, pwsh or cmd. The
  report describes exploitation of TrueConf Server (missing authentication plus code
  injection) giving arbitrary code execution, and a conferencing server has little
  reason to launch interactive shells. Matches on the parent/child relation, not on
  specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: TrueConf
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
  condition: selection
falsepositives:
- Administrators running maintenance or upgrade scripts that the TrueConf service
  launches
- Vendor installer or updater helper scripts invoking cmd.exe
level: high
id: 538c9f33-83c1-5f99-8341-0418ac3ec34d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

### TrueConf Server Process Spawning Download or Recon LOLBins

ATT&CK: T1190

A TrueConf Server process launching living-off-the-land binaries commonly used for payload download and host recon after exploiting a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: TrueConf Server Process Spawning Download or Recon LOLBins
description: Detects a TrueConf Server process spawning utilities typically used for
  post-exploitation payload retrieval, execution or host discovery (certutil, bitsadmin,
  mshta, rundll32, regsvr32, curl, whoami, net, systeminfo). Intended to catch follow-on
  activity after exploitation of the TrueConf Server auth bypass or code injection
  flaws.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: TrueConf
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \curl.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \systeminfo.exe
  condition: selection
falsepositives:
- Vendor installer or updater components calling rundll32.exe or regsvr32.exe during
  upgrades
- Administrator troubleshooting via scripts started from the TrueConf service
level: high
id: 9f201ab7-4428-5321-bbfa-d718f99c6c5c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

### TrueConf Server Process Spawning Shell on Linux

ATT&CK: T1190

A TrueConf Server process on Linux spawning a shell, suggesting command execution through exploitation of the server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: TrueConf Server Process Spawning Shell on Linux
description: Detects a TrueConf Server process on Linux spawning sh, bash or dash,
  which would be consistent with exploitation of the code injection or missing authentication
  flaws leading to arbitrary command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: trueconf
    Image|endswith:
    - /sh
    - /bash
    - /dash
  condition: selection
falsepositives:
- Service start or init wrapper scripts launched by the TrueConf package
- Package post-install or upgrade scripts
level: medium
id: 6eee3ad2-dfe8-5432-9ea3-969a335a4714
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3adfc8a4-68fe-570d-88c8-92751a83176b/cisa-flags-trueconf-server-auth-and-code-injection-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup