TrueConf Server falls with no authentication on port 4307, and Head Mare grafts PhantomCore onto it

June 18, 2026. TrueConf ships fixed builds 5.3.9, 5.4.9, and 5.5.5 for its self-hosted video conferencing server. August 11, 2026. Kaspersky documents a campaign that exploits an unpatched instance to deliver a backdoor named PhantomCore. August 20, 2026. CISA adds both flaws — CVE-2026-72529 and CVE-2026-72530 — to the KEV catalog, confirming exploitation in the wild.

For a CISO, the lesson fits in one sentence: a patch published in June stopped nothing in August, because the flaw sits on a port that should never have answered the internet.

Two flaws, one door with no handle

CVE-2026-72529 is a missing authentication for critical function (CWE-306), rated 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0. In practice, a remote unauthenticated attacker who reaches the server’s 4307/TCP port can call an undocumented function and make it run an arbitrary script. No authentication, no user interaction, no prior privilege: the only precondition is network reachability.

CVE-2026-72530 is a code injection that completes the chain. It lets the attacker escape the isolated environment the server runs in and execute arbitrary code on the host, up to NT AUTHORITY\SYSTEM on Windows deployments.

Both flaws affect the 5.3.x, 5.4.x, and 5.5.x branches up to the fixed releases of June 18, 2026, plus earlier versions. Kaspersky is the assigning CNA, which is not a footnote: it signals that the vendor-neutral security firm identified the vulnerability in the course of an incident response, not a product audit.

What Kaspersky observed

The report published on Securelist on August 11, 2026 attributes the campaign to the Head Mare group and describes an intrusion chain that uses CVE-2026-72529 as the initial entry point. The attacker connects without authentication to port 4307/TCP, invokes the vulnerable function with a malicious script, then uses CVE-2026-72530 to break out of the isolated environment and gain execution as SYSTEM.

Two things happen next, and it is the second that changes the severity of the story.

First, the compromised server becomes a distribution pivot. The attacker replaces the web interface’s locale.php file with a web shell, then swaps the legitimate TrueConf Client package for an unsigned build carrying the PhantomCore backdoor. The result: a partner whose server is breached becomes, without knowing it, the channel through which its own customers download a trojanized client.

Second, Kaspersky documented complementary modules named PhantomGraph — notably SysExcSvc.dll and SysReadSvc.dll — alongside command traffic over OneDrive, access to the LSASS process, and a reverse SSH tunnel. These are artifacts from one observed incident, not a universal checklist: the absence of these markers does not prove another server is clean.

The targeting is clear. Kaspersky points to Russian organizations in manufacturing, electronics, transport, energy, IT, and software publishing. CISA publishes no public victim count and lists ransomware use as unknown — but a KEV listing alone establishes active exploitation.

Why the June patch was not enough

The timeline is the core argument. The fixes date from June 18, 2026. Documented exploitation ran at least into August. Six weeks separate the availability of a remedy from the flaws’ KEV listing — and during those six weeks, exposed servers stayed open on a port that executes scripts with no authentication.

That gap has a structural explanation: TrueConf Server is a self-hosted product. There is no forced update channel as on a SaaS offering; the patch only exists if the team running the server downloads and applies it. A fleet of internal video conferencing servers is exactly the kind of asset you update “when there is time,” because it does not carry the critical production load.

CISA sets distinct deadlines for U.S. federal agencies: August 23, 2026 for CVE-2026-72529 and September 3, 2026 for CVE-2026-72530. The later date must not be read as a comfort window: it is an administrative constraint, not an assessment of real risk.

A recurring pattern, and a scoring paradox

CWE-306 — missing authentication for critical function — is no niche oddity: it is a whole family of flaws that hits self-hosted products whenever an internal function, never meant to be exposed, becomes reachable from the network. CVE-2026-72529 is its archetype: an undocumented server function, callable over port 4307/TCP, that executes a script without ever checking who is calling. The attacker does not need to exploit a complex bug — the function just has to exist, and the port has to be open.

One scoring detail deserves attention. The EPSS score of CVE-2026-72529 is below 1% — a predicted exploitation probability the model rates as very low. Its listing in CISA’s KEV catalog tells the opposite story: the flaw is being exploited in the wild. It is a reminder that EPSS measures statistical prevalence, not immediate danger: a flaw listed in KEV is exploited right now, whatever its predictive score.

That gap between scoring and reality reinforces the operational rule: on an exposed self-hosted product, the KEV signal outweighs any score. It flags ongoing exploitation, not a probability.

What to do

The response unfolds in three steps, in order.

Patch first. Install at least 5.3.9, 5.4.9, or 5.5.5 for your branch. If you run 5.2 or older, contact TrueConf to plan a migration to a supported branch, and do not leave port 4307 exposed while that migration is pending.

Close the port. Port 4307/TCP has no business being reachable from the internet. Restrict it to the hosts that need it, ideally behind an admin VPN. A closed port reduces risk but does not prove an already-reached host is clean: it is surface reduction, not a verdict.

Prove the intruder is gone. A patch applied to an already-compromised server removes neither the web shell, the trojanized client, nor the stolen credentials. Preserve application, web, authentication, and firewall logs; compare locale.php and the TrueConf Client packages against trusted vendor copies; then hunt for unknown services, scheduled tasks, and unusual outbound connections. Finally, rotate secrets — service accounts, API keys, certificates — from a clean machine.

For end users: if you received an unsigned TrueConf Client installer, quarantine it and check the digital signature before running anything. A familiar filename or an HTTPS download address is not enough when the supplying server is itself compromised.

Verdict

If you run TrueConf Server, the patch is not up for debate: it has been available since June 18, 2026 and the flaws are actively exploited, with no authentication, on an exposed port. Patch today, close port 4307, then treat the investigation as a task distinct from the update.

If you do not use TrueConf, the underlying signal holds for any self-hosted business communication product: software that runs on your premises inherits your patching responsibility, and an unapplied patch is a zero-day to the attacker. The winning posture is unchanged — patch fast, shrink exposure, then prove the intruder is gone.

References

• CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog, August 20, 2026
• Kaspersky Securelist — Head Mare delivers PhantomCore and PhantomGraph backdoors via an unpatched TrueConf server, August 11, 2026
• Kaspersky ICS CERT — TrueConf Server Missing Authentication for Critical Function, August 11, 2026
• TrueConf — TrueConf Server: Security Updates for June 2026, June 18, 2026
• GridinSoft — CVE-2026-72529 and CVE-2026-72530 Exploited in TrueConf Server, August 20, 2026
• NVD — CVE-2026-72529, accessed August 21, 2026