CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-72529
Critical (9.3) in TrueConf Server. In CISA KEV since 2026-08-20. EPSS 1.5% chance of exploitation in the next 30 days.
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2026-08-20, due 2026-08-23
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- trueconf:trueconf_server