CISA Orders Federal Agencies to Patch Actively Exploited TrueConf Server Flaws

CISA has added two vulnerabilities affecting TrueConf Server, a self-hosted video conferencing and communications platform, to its Known Exploited Vulnerabilities catalog, ordering U.S. federal civilian agencies to prioritize patching under Binding Operational Directive 22-01. According to BleepingComputer, both flaws are being actively exploited in the wild.

Why It Matters

TrueConf Server is self-hosted, meaning organizations running their own instance are directly responsible for patching — there's no vendor-managed cloud tier absorbing the risk. Communications and conferencing platforms like this are attractive targets: successful exploitation can expose internal meetings, credentials, and network access, and self-hosted deployments are often internet-facing to support external participants. Federal agencies face a mandated patch deadline, but any organization running TrueConf Server — government or private sector — should treat this as urgent given confirmed in-the-wild exploitation.

What Defenders Should Do

• Identify any TrueConf Server instances in your environment and confirm they are patched to the vendor's latest fixed version.
• If patching cannot happen immediately, consider restricting external network access to the server's management interfaces where feasible.
• Review TrueConf Server logs for anomalous authentication attempts, unexpected configuration changes, or unusual outbound connections that could indicate post-exploitation activity.
• Check external attack surface inventories to confirm whether TrueConf Server is exposed to the internet and, if so, apply extra scrutiny to access logs.

Specific technical details of the vulnerabilities (CVE identifiers, exploitation mechanics) were not included in the available reporting at time of writing — this is developing coverage and we'll update as more detail emerges. See the original report at BleepingComputer.