The US cybersecurity agency has ordered federal agencies to fix two security flaws in TrueConf, a Russian-developed video conferencing platform, after compromised servers began distributing malware to meeting attendees. CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog on Thursday, confirming both have been weaponized in real-world attacks. The agency didn't reveal who's being targeted or where the attacks are happening.

The only documented exploitation so far comes from security firm Kaspersky, which traced the attacks to Head Mare, a pro-Ukrainian hacktivist group. Head Mare's campaign hit Russian organizations across transport, energy, electronics, IT, and software development sectors, according to the research. The attackers combined both vulnerabilities to seize control of TrueConf servers: the first bug lets an unauthenticated attacker run malicious scripts through TCP port 4307, which sits open by default, while the second allows escape from the isolated script environment to execute arbitrary code on the underlying server. Kaspersky found the hackers installed web shells, moved laterally through victim networks, and accessed privileged TrueConf database credentials. They then swapped legitimate Windows client installers with trojanized versions carrying the PhantomCore backdoor. The flaws affect TrueConf Server releases dating back to 2022.

The research warns the threat extends beyond organizations running vulnerable TrueConf infrastructure, since employees joining conferences hosted by suppliers or partners could download compromised clients from someone else's hacked servers. TrueConf is a Moscow-based company offering on-premises video conferencing software as an alternative to cloud platforms like Zoom and Microsoft Teams, letting organizations run servers on their own infrastructure and control where call data flows. While its customer base is primarily Russian, TrueConf claims users worldwide, including Switzerland's Department of Justice and Home Affairs and Istanbul Airport, though most public case studies predate 2022.

The dual-vulnerability attack chain matters because it turns collaboration tools into distribution channels for backdoors, creating supply chain risk that crosses organizational boundaries. CISA's decision to flag these bugs is particularly notable given TrueConf's Russian origins and unclear evidence of exploitation against US targets—the agency hasn't specified whether it added the flaws because of the documented attacks on Russian entities or because it has evidence of separate campaigns, potentially against American organizations. TrueConf released patches in versions 5.3.9, 5.4.9, and 5.5.5 on June 18, cautioning that skipping the update leaves conferencing systems vulnerable to attacks over the public internet. However, exploitation requires network access to the vulnerable service, meaning servers restricted to internal networks wouldn't be directly reachable from outside unless attackers already had another entry point. Federal agencies have until September 10 to apply the fixes, while other TrueConf administrators face no formal deadline—unless they're uncomfortable with conferencing servers doubling as malware delivery infrastructure. The geopolitical dimension of patching infrastructure from adversary nations will likely force enterprises to weigh operational continuity against increasingly complex threat modeling. Organizations may find themselves caught between the technical imperative to secure known vulnerabilities and the strategic question of whether continued reliance on such platforms is defensible.