TrueConf Server, videoconferencing infrastructure deployed on-premises by organisations that don't want their calls routed through a third-party cloud, had two vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue on the same day: 20 August 2026.
CVE-2026-72529 scores 9.8. CVE-2026-72530 scores 9.0. Both require nothing more than network access to one specific port — 4307/TCP — on server versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier.
One port, two ways to abuse what answers on it
Per NVD, CVE-2026-72529 lets a remote unauthorized attacker with access to port 4307/TCP execute arbitrary commands. CVE-2026-72530 describes a remote unauthorized attacker on the same port using "a special" — NVD's description is truncated in the public record, but the pattern is legible without the missing word: a second, adjacent way to abuse the same listening service, disclosed and catalogued on the same date as the first.
That a single port carries two independently scored critical-to-high vulnerabilities is not evidence of two unrelated findings arriving by coincidence. It reads as what it almost certainly is: a security review of one service surface that turned up more than one problem, reported together.
Why a specific, named port matters here
Unlike a web application vulnerability that might be reachable through a load balancer or reverse proxy without anyone noticing, a bug tied to a specific TCP port is a concrete, checkable fact: either 4307/TCP is reachable from outside your network boundary or it is not. That makes this pair unusually actionable to verify quickly, and unusually indefensible to have missed — a port scan settles the question in minutes.
Videoconferencing infrastructure is also, structurally, in an unusual trust position. It routes real-time audio and video for meetings that frequently include the kind of institutional and personal content organisations chose not to put in cloud conferencing tools specifically to protect. A server compromise here is not primarily a data-exfiltration story — it is a live-eavesdropping story, and the confidentiality expectation attached to the software is exactly what's undermined by a remote, unauthenticated code-execution bug against it.
What the affected version list implies
The affected ranges — 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier — cover three consecutive minor release lines, each patched only at its very last point release before the fix. That pattern is consistent with a vulnerability that has existed in the codebase across several release cycles without being noticed until a dedicated review or an external report found it, rather than one introduced by a single recent change. For an operations team, it means version-checking against only the latest minor release isn't sufficient reassurance — any deployment running an earlier point release within any of these three lines remains exposed regardless of how recently it was last updated within that line.
What to check this week
Check whether port 4307/TCP is reachable from outside your network. This is the single highest-value five minutes available against this pair — a firewall rule restricting the port to trusted management networks addresses both CVEs at once, independent of patch status.
Confirm your TrueConf Server version against the affected ranges directly — 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5 are named specifically, and "we're on the latest 5.5" is not confirmation unless the installed build post-dates 5.5.5.
Treat both CVEs as one incident to investigate, not two tickets to close separately. They were disclosed together against the same port; a compromise via one plausibly leaves evidence discoverable via the other's mechanism too.
Self-hosted communications tools carry the same discovery gap as self-hosted anything
Organisations run TrueConf on-premises specifically to keep meeting content off third-party infrastructure, which is a defensible security and compliance decision — but it comes with the same tradeoff every self-hosted platform carries: the vendor cannot push a silent, automatic update the way a cloud provider can. Whoever operates the TrueConf server is solely responsible for tracking its advisories, and a two-CVE disclosure landing on a specialised on-premises product is exactly the kind of update that's easy to miss if TrueConf isn't already on a team's short list of platforms they actively monitor for security bulletins, separate from the more commonly watched vendors.
How Safeguard helps
Safeguard's continuous inventory tracks the ports and services a deployed asset actually exposes, not just the CVEs published against its name — which is what turns "is 4307/TCP reachable" from a manual question into a standing, automatically answered one. For infrastructure like TrueConf Server, where a single named port carries the entire risk of two critical vulnerabilities, that kind of exposure visibility is the difference between a five-minute firewall change and a five-day investigation into whether the change happened before or after it needed to.
