TrueConf Vulnerability Added to KEV; Check Point Observed Exploits Starting in January
NEOSEC enrichment — no mirror of the original source
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a high severity Download of Code Without Integrity Check Vulnerability (CVE-2026-3502) in the TrueConf video conferencing tool to the Known Exploited Vulnerabilities (
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
Affected vendors and products
More on TrueConf
Other advisories
- CriticalCVE-2026-72530TrueConf Server: TrueConf Server Code Injection Vulnerability
- CriticalCVE-2026-72530trueconf_server: Code-Injection
- CriticalCVE-2026-72530trueconf_server: Code-Injection
- CriticalCVE-2026-72529TrueConf Server: fehlende Authentifizierung für kritische Funktion
- CriticalCVE-2026-72529TrueConf Server: fehlende Authentifizierung für kritische Funktion
- CriticalCVE-2026-3502Der TrueConf-Client lädt den Anwendungsaktualisierungscode herunter und wendet ihn an, ohne eine Überprüfung durchzuführen.
- CriticalCVE-2026-3502TrueConf Client enthält eine Schwachstelle beim Download von Code ohne Integritätsprüfung.
- HighCVE-2025-66824TrueConf Server: Cross-Site-Scripting (XSS)
Other news entries
- Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using itNewsThe Register — Security
- CISA orders feds to patch actively exploited TrueConf Server flawsNewsBleepingComputer
- CISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesNewsSecurityWeek
- KEV: Oracle, Zimbra, TrueConfVulnerabilitySANS NewsBites
- TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCoreNewsThe Hacker News
- Hackers breach TrueConf to trojanize client installers with backdoorsNewsBleepingComputer
Source: https://research.checkpoint.com/
ID