The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
KEV ✓ EPSS 0.06 CVE-2026-3502 CVE-2026-72529 CVE-2026-72530 TrueConf veřejná správa US
Serial Number: AV26-835Date: August 20, 2026 As of August 19, 2026, TrueConf is affected by a vulnerability in the following product: TrueConf Server 5.3.x versions prior to 5.3.9 5.4.x versions prior to 5.4.9 5.5.x versions prior to 5.5.5 On August 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72529 and CVE-2026-72530 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links…
KEV ✓ EPSS 0.02 CVE-2026-72529 CVE-2026-72530 TrueConf veřejná správa CA US
CISA added CVE-2026-72529 to the Known Exploited Vulnerabilities catalog. Affected product: TrueConf Server. Remediation due date: 2026-08-23.
KEV ✓ EPSS 0.02 CVE-2026-72529 TrueConf US
CISA added CVE-2026-72530 to the Known Exploited Vulnerabilities catalog. Affected product: TrueConf Server. Remediation due date: 2026-09-03.
KEV ✓ EPSS 0.02 CVE-2026-72530 TrueConf US
Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures. In this latest campaign, the attackers exploited a chain of vulnerabilities in the TrueConf video conferencing server and replaced the original TrueConf client installers with…
TrueConf Kaspersky Microsoft energetika výroba a průmysl doprava telekomunikace RU