CVE-2026-3502 CISA KEV · Actively exploited
TrueConf Client Download of Code Without Integrity Check Vulnerability
CVSS score
—
EPSS probability
%0.3
Risk score
—
Published
6 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026. The activity involves exploiting a vulnerability chain
Similar Vulnerabilities
9.0
CVE-2026-72530 Actively exploitedCode injection in TrueConf Server
Patch status unknown Public Exploits:2EPSS %2
9.8
CVE-2026-72529 Actively exploitedMissing authentication in TrueConf Server
Patch status unknown Public Exploits:1EPSS %1
8.8
CVE-2017-20120Cross-site request forgery in Trueconf Server
Patch status unknownEPSS %0
8.7
CVE-2025-66824Cross-site scripting in Trueconf Server
Patch status unknown Public Exploits:1EPSS %0
7.3
CVE-2025-66834Vulnerability in Trueconf Server
Patch status unknown Public Exploits:1EPSS %0
7.1
CVE-2025-66835Vulnerability in Trueconf
Patch status unknown Public Exploits:1EPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-3502"