CISA adds two TrueConf Server flaws to exploited vulnerabilities catalog
CISA added CVE-2026-72529 and CVE-2026-72530 to its exploited vulnerabilities catalog and urged federal agencies to move quickly on KEV-listed issues.
CISA said on Aug. 20 that it added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.
The agency identified the flaws as CVE-2026-72529, a TrueConf Server missing authentication for a critical function flaw, and CVE-2026-72530, a TrueConf Server code injection vulnerability. CISA said vulnerabilities of this kind are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise.
CISA uses the catalog to flag flaws it says are being used in the wild. Federal agencies are expected to prioritize those issues under Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk.
CISA said BOD 26-04 sets vulnerability management requirements for Federal Civilian Executive Branch agencies. The notice says agencies should move quickly on high-risk vulnerabilities, especially CVEs in the catalog on publicly exposed assets that could grant total control after exploitation. It also says agencies should defer lower-risk items and check whether threat actors may have compromised a system before patching it.
CISA said the directive applies only to FCEB agencies, but it encourages all organizations to use risk-based vulnerability management and to prioritize remediation of KEV Catalog entries.
The agency also said it will continue to add vulnerabilities that meet its criteria. It invited submissions through its KEV Nomination Form for exploited vulnerabilities that are not yet listed, provided they have a CVE ID, evidence of exploitation and clear mitigation guidance.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()