EUVD Vulnerability Catalog Actively Exploited (KEV)

EUVD-2026-62587

Severity: CRITICAL Base Score: 9.3 CVSS Version: 4.0

Vulnerability Description

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): High

▪ Subsequent Confidentiality Impact (SC): None

▪ Subsequent Integrity Impact (SI): None

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor TrueConf

References & Advisory Links

https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

Kaspersky

EPSS Probability

0.79

Known Aliases

GHSA-xc2x-q39j-746f CVE-2026-72529

Published On

2026-08-19

Last Updated

2026-08-21

Exploited Since

2026-08-20