TrueConf Server Chained Exploitation: CVE-2026-72529 + CVE-2026-72530 — The Supply-Chain Vulnerability Inside Your Self-Hosted Conferencing Appliance

Executive summary

A pair of high-severity flaws in TrueConf Server lets an unauthenticated attacker take over the server and replace every client installer it distributes — a one-box supply-chain compromise. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20 with enforcement deadlines of August 23 and September 3, respectively. Fixes (TrueConf Server 5.3.9 / 5.4.9 / 5.5.5) shipped June 18, 2026; Head Mare began chaining them in July 2026 against unpatched deployments.

Affected ranges: 5.3.x through 5.3.8, 5.4.x through 5.4.8, 5.5.x through 5.5.4, and earlier (Windows and Linux). The vendor lists TrueConf Server as deployed by governments, courts, telecoms, banks, Fortune 500 companies, and many mid-size enterprises worldwide — but the unpatched proportion cannot be verified from public data.

Why this matters beyond "another CVE to patch": TrueConf Server is a self-hosted conferencing appliance and the distribution point for its own desktop client. After chaining these two flaws, Head Mare replaced trueconf_windows_client_x64.exe with an unsigned Inno Setup build that installs PhantomCore (a backdoor DLL) on every endpoint that downloads it — including guest and web participants from organizations that don't even run TrueConf. That is the supply-chain problem. This advisory walks through the chain, the tamper mechanism, how to spot a compromise in your logs, and what to do about it.

The 4307/TCP chain explained technically

Port 4307/TCP is TrueConf Server's main service port — open by default per vendor documentation. Kaspersky ICS CERT assigned the first vulnerability (CVE-2026-72529) to an undocumented function reachable unauthenticated on that port, meaning "call it from outside with no credentials and you get arbitrary script execution on the server." The second (CVE-2026-72530) is a code-injection flaw in the server's isolated execution environment — an intentionally sandboxed runtime where hazardous operating-system libraries (io, os etc.) are blocked. A specially crafted script breaks out of that sandbox and runs commands with NT AUTHORITY\SYSTEM privileges on Windows hosts [1][2][3].

Observed in the wild (Head Mare, July 2026), the chain executes in these stages:

1. Stage 1 — Connect: unauthenticated TCP to port 4307 (open by default; no authentication of any kind required).
2. Stage 2 — Script execution (CVE-2026-72529): call a server function that transmits and runs an arbitrary script inside the isolated environment. The sandbox blocks OS-level calls, so on its own this primitive is sandboxed script execution — not host code execution.
3. Stage 3 — Sandbox escape (CVE-2026-72530): a specially crafted script exploits improper management of code generation in the isolated environment to break out and run commands as NT AUTHORITY\SYSTEM [1][2][4].

What is NOT disclosed by primary sources: the function's name, method ID, request encoding, or protocol; the sandbox language; the exact escape primitive. All primary reporting describes these only as "undocumented" — they should not be presented as facts downstream [3].

After gaining SYSTEM access, the observed Head Mare chain continues: plant a web shell (locale.php), conduct infrastructure recon, read the TrueConf database, replace the client installer (next section), and install the PhantomGraph backdoor.

Client-installer tamper mechanism and integrity bypass

This is where the supply-chain angle becomes concrete.

The file that gets swapped. C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe — the installer TrueConf Server serves to every x64 participant joining a meeting — was observed replaced via the planted web shell in SYSTEM context [5][6]. Two trojanized builds confirmed in-the-wild:

The trojanized installer installs the legitimate TrueConf client and simultaneously deploys PhantomCore to %LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll, persisting via HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 (COM InprocServer32 hijack) [5].

Which integrity check breaks. Legitimate TrueConf distributions carry a vendor Authenticode code signature and are published with verifiable checksums on the downloads page. The trojanized builds lack any valid digital signature — which is why Kaspersky can detect them by absence, and why EDR rule unsigned_trueconf_installer flags an unsigned installer [5].

Critical nuance for operators: nothing was cryptographically bypassed. The server→client distribution path enforces no integrity check at all. A signature-less build is indistinguishable from a legitimate one to the delivery mechanism — it simply lacks the signature that never gets verified. This is "integrity control not enforced on the distribution path," not an attacker technique that defeated verification.

The client-side enabler is corroborated by TrueConf's own disclosure of CVE-2026-3502 (CWE-494, CVSS 7.8, KEV since April 2026): "the client update mechanism can apply downloaded update code without sufficient verification." This vulnerability was exploited in a separate campaign (Havoc C2 targeting Southeast Asian governments), but it confirms the same design weakness on the client side [5][7].

Distribution mechanism and blast radius. TrueConf Server stores its clients under ClientInstFiles\ and serves them itself. After the swap, every x64 participant receives a "new version available" download prompt — including web/guest participants joining via browser. Kaspersky's explicit warning: "Even if your organization does not use a TrueConf server, your employees may connect to compromised TrueConf servers of contractors to participate in online meetings and download infected installation packages" [5][6]. Only the Windows x64 client distribution was observed tampered; no other OS/architecture was reported.

Deployment exposure assessment

TrueConf Server is a self-hosted conferencing platform with deployments ranging from small offices (via the free tier, up to 1,000 users) through Fortune 500 companies and government agencies worldwide [8]. The vendor lists customers in India, Vietnam, Mexico, Canada, Brazil, Switzerland, Laos, Czech Republic, Germany — plus HAL (30,000+ employees), Indian Space Research Organisation, and UNDP among named accounts.

Affected version exposure. Several thousand active installations are estimated globally across the affected range, with a meaningful concentration in Russia/Belarus where Head Mare has primarily targeted [8]. Exact install-base counts cannot be verified — the vendor does not publish them, and no reliable Shodan/Censys port 4307 scan was available for this analysis.

Port 4307/TCP is open by default. No initial reconnaissance is needed beyond confirming reachability on the network. The exploit requires no credentials, privileged access, or social engineering [8]. Once an attacker reaches SYSTEM via the chain, full persistent backdoor installation plus mass client compromise follow in a single campaign.

Secondary (off-chain) exposure. Organizations that do not run TrueConf Server are exposed through employees who join meetings hosted on compromised third-party servers — vendors, partners, and contractors using their own TrueConf instances. The combination of unauthenticated server takeover plus unsigned-client-install distribution means the blast radius extends well beyond the hosting organization [5][6].

Indicator-of-compromise guide for operators

Port 4307/TCP exploitation signals

• Unusual outbound connections from TrueConf Server process to unknown C2 IPs/domains (IOC set in Kaspersky advisories).
• Any activity on port 4307 that is not normal client-server signaling — the documented protocol does not require inbound script delivery by unauthenticated actors.

Web shell deployment

• File: C:\Program Files\TrueConf Server\httpconf\site\public\js\locale.php
• MD5: 4d27b4eb1c5dbb3d8160f29b8119523e (Backdoor.PHP.WebShell.abi per Kaspersky) [3][5]

Installer tamper indicators

• Any modification to C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_windows_client_x64.exe after patching. Verify against vendor checksums on https://trueconf.com/downloads/windows.html.
• An unsigned Inno Setup build in that directory — Kaspersky YARA rule apt_HeadMare_FakeConf_installer matches the observed trojanized build (zero Authenticode signatures).
• PhantomCore MD5: c5a460e4e68a088f6e51b2c6474642ec in any TrueConf-related directory.
• Registry persistence: HKCU\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32 — legitimate installations do not use this key [5].

Post-compromise outbound patterns

• SysExcSvc / SysReadSvc services communicating externally (PhantomGraph backdoor, OneDrive/Graph C2 channel) [3][4]
• SSH reverse tunnels from TrueConf Server hosts
• Outbound connections to the IOC IP/domain set published by Kaspersky

Detection rules to deploy

• KEDR rule: TrueConfServerUnsignedInstaller — flag any installer in ClientInstFiles\ lacking a valid code signature [5]
• YARA rule apt_HeadMare_FakeLocale_webshell: detect locale.php deployment with the known hash pattern
• File-integrity monitoring on httpconf/site/public/js/ and ClientInstFiles\

IOC currency note: The MD5 hashes and YARA rule names in this detection section are valid at time of publication (2026-09-02). Validate them against the latest Kaspersky threat feed before operational use.

Note: Security Affairs misstates the CVE-2026-72530 KEV due date as September 2; the authoritative CISA KEV feed gives 2026-09-03 [7]. The "all versions since 2022 vulnerable" claim comes from Kaspersky internal analysis and should be attributed, not stated as fact.

Mitigation and response recommendations

Immediate (within the CISA enforcement deadlines)

1. Inventory all TrueConf Server instances; confirm version against affected ranges (5.3.x–5.3.8, 5.4.x–5.4.8, 5.5.x–5.5.4).
2. Upgrade to 5.3.9 / 5.4.9 / 5.5.5 immediately — fixes released 2026-06-18 [3][5]. This closes both CVEs in a single upgrade.
3. If you cannot patch immediately: close port 4307/TCP to the public internet (retain internal access only if required); deploy EDR file-integrity monitoring on httpconf/site/public/js/ and ClientInstFiles\; alert on any unsigned installer appearing in ClientInstFiles\.

Post-patch response

4. Rotate all TrueConf credentials — including the PostgreSQL account referenced by the planted web shell [3].
5. Verify client installers against vendor-supplied checksums; force re-download of the client to all endpoints from a verified source.
6. Scan affected endpoints for PhantomCore (api-ms-win-crt-time-l1-1-0-2.dll in any TrueConf\Client\* path) and the persistence registry key [5]. Use Kaspersky's published YARA rules as detection starting points [3].
7. Check network egress for connections to SysExcSvc/SysReadSvc or outbound SSH reverse tunnels from TrueConf Server hosts — these indicate active compromise even post-patch.

Structural hardening

8. Treat self-hosted conferencing servers with the same supply-chain hygiene as any distribution point: verify signed builds at install time, alert on signature absence, and periodically audit installed binaries against vendor-provided hashes. The design weakness that made this attack possible — no integrity check on the server→client path — exists independently of whether an attacker exploits it today.

Cross-links (MalwLab related drafts)

• When Your Self-Hosted App Lands in CISA KEV: The Operator 72-Hour Response Checklist
• Beyond the Appliance: What Q3's Remote-Access Cluster Teaches Us About Management-Surface Defense
• PaperCut NG/MF Zero-Day Pair (CVE-2026-81578 + CVE-2026-82078) — The Forgotten Self-Hosted App, Actively Exploited — same forgotten-self-hosted-app neighborhood; the PaperCut advisory uses a similar structure and can be cross-linked from this piece.

Note: all three cross-links point to MalwLab drafts that are not yet published — each link resolves once the corresponding article ships.

Sources (verified live 2026-09-02 against primary reporting)

1. KLCERT-26-057 (CVE-2026-72529), Kaspersky ICS CERT, 2026-08-11: https://ics-cert.kaspersky.com/vulnerabilities/trueconf-server-missing-authentication-for-critical-function
2. KLCERT-26-058 (CVE-2026-72530), Kaspersky ICS CERT, 2026-08-11: https://ics-cert.kaspersky.com/vulnerabilities/trueconf-server-breakout-from-isolated-environment
3. Securelist threat analysis, "Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph": https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988
4. ICS CERT threat alert (2026-08-12), "Head Mare APT Group exploits vulnerabilities in unpatched TrueConf server to deliver PhantomCore malware": https://ics-cert.kaspersky.com/publications/reports/2026-08-12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware/
5. NVD API records: CVE-2026-72529 — https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-72529 ; CVE-2026-72530 — https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-72530
6. CISA KEV catalog (live JSON, both entries verified): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
7. TrueConf vendor security advisory page: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; downloads + checksum-verification section: https://trueconf.com/downloads/windows.html
8. Security Affairs coverage (secondary): https://securityaffairs.com/197602/security/u-s-cisa-adds-trueconf-server-flaws-to-its-known-exploited-vulnerabilities-catalog.html