Organizations running self-hosted TrueConf Server should update now. CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog on August 20, 2026. Treat this as a production maintenance priority: use TrueConf’s current security release path, validate core conferencing services, and resolve any unsupported-server decision promptly.
This is defensive administrator guidance. It intentionally avoids attack detail. CISA directs organizations to follow vendor mitigation guidance or discontinue use when mitigations are unavailable.
Who Should Act
- Organizations operating TrueConf Server on their own Windows or Linux infrastructure.
- IT teams responsible for conferencing, collaboration, and internal communications platforms.
- Managed-service teams that administer TrueConf Server for customers.
Use the Current TrueConf Security Release
TrueConf’s June 2026 security update recommends upgrading to the current published maintenance releases: 5.5.5, 5.4.9, or 5.3.9, as appropriate for the supported release family. Confirm the correct path for your deployed operating system and version with the official TrueConf guidance before changing production.
- Identify every self-hosted TrueConf Server instance and record its installed version, operating system, public exposure, and service owner.
- Review the official TrueConf security update guidance and select the supported current release for that instance.
- Use normal change control, including a tested recovery path and a named owner for post-update service validation. Do not create or alter a backup schedule solely for this update.
- Apply the update through the approved vendor administration workflow, then keep the platform within its supported maintenance path.
Validate Services After Updating
- Confirm the server reports the intended version after the maintenance window.
- Check administrator access, user sign-in, a representative conference, supported client connections, and any required directory or calendar integrations.
- Review normal platform and hosting alerts for verified post-maintenance problems, then address them through the established support process.
- Confirm public exposure is intentional and that administrator access is limited to approved users.
If You Cannot Update Immediately
Reduce unnecessary exposure of the server and its management functions, restrict administrator access, and schedule the earliest practical supported maintenance window. Do not treat temporary access restrictions as a permanent substitute for the vendor security update. If a supported mitigation cannot be applied, CISA’s KEV guidance is to discontinue use of the affected product.
Related FixItPhill Guidance
Use the FixItPhill security library for broader maintenance priorities. Teams that also maintain customer websites can use the WordPress support hub for routine site maintenance and verification guidance.