CVE-2026-72529 Splunk · SPL

Detect TrueConf Server Missing Authentication for Critical Function (CVE-2026-72529) in Splunk

Detects exploitation attempts against CVE-2026-72529, a missing-authentication-for-critical-function vulnerability (CWE-306) in TrueConf Server. Unauthenticated attackers can invoke privileged administrative or management functions without supplying credentials, potentially enabling configuration changes, account takeover, or full server compromise. This CVE is listed in CISA's KEV catalog, indicating confirmed in-the-wild exploitation. The detections identify unauthenticated access to sensitive TrueConf Server administrative endpoints (web management console, API, and configuration interfaces) and anomalous privileged actions performed without a preceding authentication event.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=web (sourcetype="iis" OR sourcetype="trueconf:access" OR sourcetype="apache:access")
(uri_path="*/admin*" OR uri_path="*/api/*" OR uri_path="*config*" OR uri_path="*/settings*" OR uri_path="*/system/*" OR uri_path="*/users/create*")
(method=POST OR method=PUT OR method=DELETE OR method=PATCH)
status IN (200,201,204,302)
(user="-" OR user="" OR isnull(user)) (cookie="-" OR cookie="" OR isnull(cookie))
| stats count AS request_count values(uri_path) AS paths values(method) AS methods by src_ip, dest, _time span=10m
| where request_count >= 1
high severity medium confidence

Flags Splunk-indexed web/access logs showing successful privileged TrueConf Server requests lacking authenticated user or session context, indicating CVE-2026-72529 abuse.

Data Sources

IIS Web Server LogsTrueConf Server access logsWeb Proxy

Required Sourcetypes

iistrueconf:accessapache:access

False Positives & Tuning

  • Uptime monitors probing unauthenticated endpoints on a schedule
  • Proxy layers that normalize away user/cookie fields before Splunk ingestion
  • Internal admin automation whose auth token is not captured in the access log

Other platforms for CVE-2026-72529

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated POST to TrueConf admin endpoint

    Expected signal: IIS/web access log entry for POST /admin/api/config with empty username and cookie fields and a 2xx/3xx status.

  2. Test 2Unauthenticated privileged user-creation request

    Expected signal: Access log entry for POST /users/create with no authenticated session; TrueConf audit log may record a new account creation.

  3. Test 3Unauthenticated configuration read/change via PUT (Windows)

    Expected signal: W3CIISLog entry for PUT /api/v1/settings with empty cs-username and cs(Cookie) fields.

Last updated: 2026-08-21 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the target host is running TrueConf Server and identify its version; cross-reference against TrueConf's security advisory (https://trueconf.com/blog/news/security-fixes-updates-and-advisories) to determine if it is unpatched.
  2. Review the flagged web/access logs to confirm the requests reached privileged administrative or configuration endpoints and returned success codes without an authenticated session.
  3. Determine whether the source IP is internal (monitoring/automation) or external/untrusted, and whether it appears across other alerts or threat-intel feeds.
  4. Check for any configuration changes, new/modified user accounts, or privileged actions on the TrueConf Server timestamped near the unauthenticated requests.

Containment

  1. Restrict access to the TrueConf Server administrative and API interfaces to trusted management networks via firewall/ACL, or take the server offline if active compromise is confirmed.
  2. Apply the vendor security update for CVE-2026-72529 immediately per CISA BOD 26-04, or implement the vendor-recommended mitigation if a patch is not yet deployable.
  3. Block the offending source IP(s) at the perimeter and invalidate any sessions or credentials that may have been created or altered.

Evidence Collection

  1. Preserve full IIS/web server access logs, TrueConf Server application and audit logs, and any WAF/proxy logs covering the activity window.
  2. Capture the current TrueConf Server configuration, user/account database, and any scheduled tasks or newly created service accounts for forensic comparison against a known-good baseline.

Escalation Criteria

  • !Escalate to incident response if unauthenticated requests resulted in confirmed configuration changes, new administrative accounts, or evidence of lateral movement.
  • !Escalate to management and comply with CISA BOD 26-04 reporting timelines if the server is internet-exposed, unpatched, and shows signs of active exploitation.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >IIS/web server access logs showing privileged requests with empty username/session fields
  • >TrueConf Server audit and configuration change logs
  • >New or modified user accounts and administrative role assignments in the TrueConf user store
  • >Server configuration file modification timestamps

Tuning Guidance

Baseline legitimate unauthenticated traffic (health checks, uptime monitors, load-balancer probes) and add their source IPs and specific benign URIs to an allowlist. If the reverse proxy or load balancer strips username/cookie fields, incorporate authentication decisions from an upstream log source rather than relying solely on IIS-recorded fields to reduce false positives. Tighten the path list to the exact administrative routes exposed by your TrueConf Server version once confirmed.

Hunting Queries

Surface source IPs generating high volumes of unauthenticated requests to TrueConf Server privileged endpoints for retrospective hunting of CVE-2026-72529 abuse.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has_any ("/admin", "/api/", "config", "/system/") | where isempty(csUsername) or csUsername == "-" | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h) | sort by count_ desc
Hunting — SPL
spl 
index=web (sourcetype=iis OR sourcetype=trueconf:access) (uri_path="*/admin*" OR uri_path="*config*" OR uri_path="*/api/*") (user="-" OR user="") | stats count by src_ip, uri_path | sort - count

Atomic Red Team Tests

Test 1 Unauthenticated POST to TrueConf admin endpoint
linux

Simulates an unauthenticated attacker invoking a privileged TrueConf Server administrative function via POST without credentials.

Command

bash 
curl -s -o /dev/null -w '%{http_code}' -X POST 'http://trueconf-lab.local/admin/api/config' -H 'Content-Type: application/json' --data '{"action":"test"}'

Cleanup

bash 
echo 'No cleanup required; no persistent change made in lab test'

Expected Telemetry

IIS/web access log entry for POST /admin/api/config with empty username and cookie fields and a 2xx/3xx status.

Expected Detection

KQL and SPL rules flag the unauthenticated privileged POST request within the 10-minute aggregation window.

Test 2 Unauthenticated privileged user-creation request
linux

Attempts to create a new administrative user on TrueConf Server without authenticating, exercising the missing-authentication flaw.

Command

bash 
curl -s -X POST 'http://trueconf-lab.local/users/create' -H 'Content-Type: application/json' --data '{"username":"atomic_test","role":"admin"}'

Cleanup

bash 
curl -s -X DELETE 'http://trueconf-lab.local/users/atomic_test' || echo 'remove atomic_test user manually in lab'

Expected Telemetry

Access log entry for POST /users/create with no authenticated session; TrueConf audit log may record a new account creation.

Expected Detection

Detection rules alert on the unauthenticated POST to the user-creation endpoint returning success.

Test 3 Unauthenticated configuration read/change via PUT (Windows)
windows

Uses PowerShell to send an unauthenticated PUT to a TrueConf Server configuration endpoint, simulating CVE-2026-72529 configuration tampering.

Command

powershell 
powershell -c "try { Invoke-WebRequest -Uri 'http://trueconf-lab.local/api/v1/settings' -Method PUT -Body '{\"setting\":\"value\"}' -ContentType 'application/json' -UseBasicParsing } catch { $_.Exception.Response.StatusCode.value__ }"

Cleanup

powershell 
powershell -c "Write-Host 'Restore original TrueConf config from backup if changed in lab'"

Expected Telemetry

W3CIISLog entry for PUT /api/v1/settings with empty cs-username and cs(Cookie) fields.

Expected Detection

KQL rule matches the unauthenticated PUT to the settings endpoint returning a success status.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections