5 minhigh
CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-72529, CVE-2026-72530)
CISA added two actively exploited TrueConf Server vulnerabilities to the KEV Catalog: CVE-2026-72529 (missing authentication for critical function) and CVE-2026-72530 (code injection). Federal agencies are required by BOD 26-04 to remediate these on publicly exposed assets. CISA recommends all organizations prioritize patching these vulnerabilities.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2026-72529Missing authentication for critical function vulnerability that is being actively exploited.
- cveCVE-2026-72530Code injection vulnerability that is being actively exploited.
Detection / Hunteropenrouter
What Happened
CISA has identified two security flaws in TrueConf Server software that attackers are actively exploiting. One flaw allows access without proper authentication, and the other allows attackers to inject malicious code. Federal agencies are required to fix these issues promptly, and CISA advises all organizations to do the same. Organizations running TrueConf Server should apply available patches immediately and check whether their systems were compromised before the patch was applied.
Key Takeaways
- CISA added two TrueConf Server vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
- CVE-2026-72529 is a missing authentication for critical function vulnerability in TrueConf Server.
- CVE-2026-72530 is a code injection vulnerability in TrueConf Server.
- BOD 26-04 requires FCEB agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.
- CISA encourages all organizations, not just federal agencies, to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog entries.
Affected Systems
- TrueConf Server
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-72529 | TrueConf Server | Missing authentication for critical function vulnerability that is being actively exploited. | |
| CVE-2026-72530 | TrueConf Server | Code injection vulnerability that is being actively exploited. |
Attack Chain
- Initial Access: Attacker exploits CVE-2026-72529 (missing authentication) or CVE-2026-72530 (code injection) on an exposed TrueConf Server instance
- Execution: Code injection allows attacker-controlled code execution on the server
- Persistence and Impact: Total control of the affected asset post-exploitation
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in this advisory. Organizations should consult TrueConf security advisories for patch and mitigation guidance.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The advisory does not describe post-exploitation behavior or specific indicators. EDR visibility depends on what the attacker does after exploiting the TrueConf Server vulnerabilities. |
| Network Visibility | Medium | Network monitoring for unauthenticated access attempts or anomalous traffic to TrueConf Server instances may detect exploitation attempts. No specific network signatures are provided. |
| Detection Difficulty | Moderate | Detecting exploitation requires monitoring TrueConf Server application logs for unauthenticated access or code injection patterns. Without vendor-provided detection guidance or signatures, identifying exploitation requires custom log analysis. |
Required Log Sources
- TrueConf Server application logs
- Web server access logs
- Network firewall logs for TrueConf Server ports
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unauthenticated access to TrueConf Server administrative functions, which may indicate exploitation of CVE-2026-72529. | TrueConf Server application logs, reverse proxy or load balancer access logs | Initial Access | Medium — legitimate administrative access without authentication may occur in misconfigured environments. |
| Consider hunting for anomalous code execution or unexpected process spawns originating from the TrueConf Server process, which may indicate exploitation of CVE-2026-72530. | EDR process telemetry, Sysmon Event ID 1 (Process Creation), Sysmon Event ID 11 (File Creation) | Execution | Low to Medium — TrueConf Server may spawn child processes as part of normal operation; baseline behavior is needed. |
Control Gaps
- WAF rules may not detect missing authentication exploitation if requests appear structurally valid.
- Network IDS signatures are not available for these specific CVEs from the advisory.
Key Behavioral Indicators
- Unauthenticated requests to TrueConf Server administrative or critical function endpoints
- Unexpected child processes spawned by the TrueConf Server service process
- Anomalous outbound network connections from the TrueConf Server host
False Positive Assessment
Low — exploitation detection focused on unauthenticated access to TrueConf Server critical functions and unexpected code execution from the server process should have minimal false positives when properly baselined.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Identify all TrueConf Server instances in your environment and check for available patches from the vendor.
- If patching is not immediately possible, consider restricting network access to TrueConf Server instances to trusted IP ranges only.
- Investigate whether TrueConf Server systems were compromised before patches were applied by reviewing application and system logs for anomalous activity.
Infrastructure Hardening
- Evaluate whether TrueConf Server instances need to be publicly exposed; consider placing them behind a VPN or zero-trust network access layer.
- If a WAF is deployed in front of TrueConf Server, evaluate whether custom rules can detect and block unauthenticated access to critical functions.
User Protection
- Ensure TrueConf Server endpoints are monitored by EDR or equivalent endpoint telemetry for post-exploitation behavior.
- Consider implementing network segmentation to isolate TrueConf Server from critical internal resources.
Security Awareness
- Incorporate CISA KEV Catalog monitoring into existing vulnerability management processes so newly added entries trigger prioritized patching workflows.
- Ensure vulnerability management teams are aware of BOD 26-04 requirements and the broader recommendation for all organizations to prioritize KEV Catalog remediation.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping1 technique
Tactic
