CISA Adds Two TrueConf Server Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-72529 is described as a TrueConf Server Missing Authentication for Critical Function Vulnerability. CVE-2026-72530 is described as a TrueConf Server Code Injection Vulnerability.

CISA noted that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The additions were made under Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk for Federal Civilian Executive Branch (FCEB) agencies.

CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities, particularly on publicly exposed assets that grant total control of the asset post-exploitation. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria of a CVE ID, evidence of exploitation, and clear mitigation guidance.