TrueConf Server CVE-2026-72530

The concrete prerequisite is network reachability to TCP port 4307 on an affected TrueConf Server (5.3.x≤5.3.9, 5.4.x≤5.4.9, 5.5.x≤5.5.5, or earlier) plus the ability to submit a script to that port's interpreter feature; no authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited by the vendor-assessed high attack complexity (AC:H) and a specific attack requirement (AT:P in the 4.0 vector), meaning a particular condition or state must hold for the sandbox breakout to succeed - this is not a guaranteed single-request compromise. Realistic exposure therefore depends on whether port 4307 is reachable from untrusted networks; a server with 4307 firewalled to trusted hosts substantially reduces attackability even while unpatched.

The signals are mixed but lean toward genuine priority: the impact ceiling is maximal (unauthenticated network-facing RCE with a scope change from a sandbox to the host, VC/VI/VA and SC/SI/SA all High), yet the vendor's own CVSS 4.0 vector tempers likelihood with AC:H (high attack complexity) and AT:P (a specific attack requirement / precondition must be met), indicating the breakout is not a trivial single-shot payload. No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is currently no evidence of active or automatable exploitation - the danger is potential rather than demonstrated in-the-wild. Given that TrueConf is typically deployed on-premises and port 4307 may be exposed on internal or, in misconfigured cases, internet-facing hosts, any operator running an affected version - even a mid-sized municipal IT team in olsztyn should treat this as urgent and patch promptly rather than waiting for exploitation to appear. In short: high real-world severity ceiling, moderated attack complexity, and no confirmed exploitation yet - a strong candidate for prompt remediation but not a confirmed emergency zero-day.

An attacker who can reach the TrueConf Server on TCP port 4307 - for example from a compromised internal host or across a flat network - sends a specially crafted script to the scripting endpoint that abuses the interpreter to escape its sandbox and execute operating-system commands on the host. From there the attacker gains code execution at the privilege level of the server process and can pivot into the internal network. No public proof-of-concept is referenced, and the vendor CVSS notes high complexity and a specific attack precondition, so a working exploit likely requires meeting a particular condition rather than a trivial one-line payload.