CISA announced on Thursday that it has added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to apply patches by September 10. Both flaws have been observed being used in attacks, according to Kaspersky, which attributed the activity to the pro‑Ukrainian hacktivist group Head Mare.

TrueConf is a Russian‑developed video conferencing platform that can be run on‑premises. The two vulnerabilities allow an unauthenticated attacker with network access to port 4307 to execute malicious scripts and then run arbitrary code on the server, enabling the installation of a web shell and a trojanized client that carries the PhantomCore backdoor, Kaspersky reported.

CISA did not specify whether the inclusion in the KEV catalog was based on the documented attacks or on additional evidence of exploitation, including potential use against U.S. organizations. The agency requires patching of the two flaws for federal agencies, while other TrueConf administrators may delay updates if they consider the risk acceptable.

The vulnerabilities affect TrueConf Server releases from 2022 onward; fixes were released on June 18 for versions 5.3.9, 5.4.9 and 5.5.5. Exploitation requires direct network access to the vulnerable service, but compromised servers could be used to distribute malware to participants in third‑party conferences.

The deadline for federal agencies is September 10; the broader impact on other users remains under assessment.