CISA has added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-72529 is a missing authentication for a critical function, meaning attackers may reach sensitive server functionality without valid credentials, while CVE-2026-72530 is a code injection flaw that can enable arbitrary code execution.
The authentication-bypass issue is especially relevant from an identity and access perspective: a missing auth check on a critical function undermines the trust boundary that normally gates privileged operations, and when chained with code injection can hand attackers control over the server. Under Binding Operational Directive 26-04, FCEB agencies must prioritize rapid remediation of high-risk, exploited flaws on publicly exposed assets and verify whether systems were compromised before patching.
What to take away: Any internet-facing TrueConf Server deployments should be patched immediately and reviewed for signs of pre-patch compromise, particularly unauthorized access to privileged functions.