CISA Issues Emergency Directive to Patch Actively Exploited TrueConf Server Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. According to the directive, the vulnerabilities—identified as CVE-2026-20201 and CVE-2026-20202—are being actively exploited in the wild. CVE-2026-20201 is described as allowing unauthenticated remote code execution, while CVE-2026-20202 enables privilege escalation. The emergency directive mandates that federal agencies apply the latest TrueConf Server updates to reduce the risk of unauthorized access and code execution. CISA noted that the active exploitation of these flaws poses immediate risk to federal systems, and that organizations using TrueConf Server globally are vulnerable if unpatched. Vendor patches are available, and CISA urges immediate application to mitigate the reported exploitation. The directive highlights the critical nature of the vulnerabilities, given their potential for remote code execution and privilege escalation without authentication requirements.