Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CISA KEV patch directive for TrueConf Server flaws

Public Sector Action
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV catalog and ordered FCEB agencies to secure TrueConf Server within two weeks, forcing rapid federal response to actively exploited vulnerabilities. The affected product is a self-hosted secure messaging and video-conferencing platform that runs inside an organization's LAN, so exposure can reach internal networks. The directive addresses flaws that can enable unauthenticated script execution and remote code execution.

Related Happenings

TrueConf Server actively exploited arbitrary code execution and sandbox escape flaws security flaw

Vulnerability
H score42 First: 08.08.2026 17:16 Last: 08.08.2026 17:16 Sources 1

About this happening: TrueConf Server vulnerabilities KLCERT-26-057 and KLCERT-26-058 were exploited in July 2026 by Head Mare against unpatched Russian companies using exposed...

Open Happening

Knaithe / KnYuan AI-orchestrated exploitation campaign targeting internet-exposed infrastructure in Asia

Campaign
H score47 First: 31.07.2026 18:00 Last: 31.07.2026 18:00 Sources 1

About this happening: The knaithe / KnYuan campaign is an AI-orchestrated exploitation activity tied to Hermes Agent and DeepSeek, with Unit 42 describing autonomous enumeration and...

Open Happening

CISA BOD 26-04 patch directive for CVE-2026-16232

Public Sector Action
H score37 First: 23.07.2026 11:13 Last: 23.07.2026 11:13 Sources 1

About this happening: CISA added CVE-2026-16232 to its known exploited vulnerabilities catalog and ordered U.S. federal agencies to patch vulnerable SmartConsole instances by July 25*...

Open Happening

CISA sets June 28 patch deadline for Cisco Unified Communications Manager Server

Public Sector Action
H score35 First: 26.06.2026 22:43 Last: 26.06.2026 22:43 Sources 1

About this happening: CISA ordered federal agencies to patch CVE-2026-20230 in Cisco Unified Communications Manager Server by June 28, tightening exposure around an actively exploited...

Open Happening

CISA KEV order for FCEB agencies on LiteSpeed cPanel flaw

Public Sector Action
H score36 First: 16.06.2026 13:47 Last: 16.06.2026 13:47 Sources 1

About this happening: CISA added the LiteSpeed cPanel user-end plugin flaw to KEV and ordered Federal Civilian Executive Branch agencies to secure systems within three days under ...

Open Happening

Timeline

  1. 21.08.2026 15:25 2 articles · 3h ago

    CISA orders federal agencies to patch two actively exploited TrueConf Server flaws

    Legal Policy Action Update

    CISA added CVE-2026-72529 and CVE-2026-72530 to its KEV catalog and ordered U.S. Federal Civilian Executive Branch agencies to secure TrueConf Server instances within two weeks, by September 3, after describing the vulnerabilities as actively exploited. Kaspersky separately said Head Mare has been exploiting both flaws since at least July 2026 to replace client installers with malicious versions that deploy backdoor malware, with campaigns targeting Russian organizations across transportation, energy, IT, electronics, and software development.

    Show sources
    Open in new tab