The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform.
TrueConf Server is designed for secure corporate messaging and video conferencing and, unlike cloud-based software like Zoom or Microsoft Teams, it operates inside an organization's local network (LAN).
The most severe is a critical missing authentication security flaw (tracked as CVE-2026-72529) that allows attackers without privileges to remotely execute arbitrary scripts on unpatched servers.
"A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server," the TrueConf security team explains.
The second is another critical severity vulnerability (CVE-2026-72530) that unauthenticated threat actors can exploit through high-complexity code injection attacks to gain remote code execution.
