CISA Gives Agencies Two Weeks to Patch Exploited TrueConf Vulnerability
Summary
CISA set an April 16 deadline for federal agencies to patch actively exploited CVE-2026-3502 in TrueConf. Check Point says the TrueChaos campaign used compromised on-premises servers to distribute malicious updates.
Key points
- CISA ordered federal agencies to patch CVE-2026-3502 by April 16; the article gives its severity score as 7.8 out of 10.
- Check Point reported that the TrueChaos campaign targeted government entities in Southeast Asia beginning in early 2026.
- The flaw affects TrueConf’s updater validation and can let an attacker controlling an on-premises server distribute and execute arbitrary files on connected endpoints.
- Attackers reportedly replaced update packages on compromised TrueConf servers, then used the normal client update process to deliver malicious files.
- Check Point said the campaign typically used the Havoc tool and attributed it to Chinese actors based on tactics and hosting evidence; it also observed ShadowPad use against the same victim.
- TrueConf released a fix in March, following disclosure from Check Point.
Article Details
- Vulnerability Types
- Updater validation vulnerability enabling distribution and execution of arbitrary files
- Severity
- High (7.8/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainAttackers replaced the update package on compromised on-premises TrueConf servers and used the trusted updater channel to distribute malicious files to connected endpoints.T1204.001 · Malicious LinkCheck Point said infections likely began with links sent to victims; victim interaction launched the TrueConf client and displayed a malicious update prompt.
CVE
Malware
Vendors
Alibaba CloudCheck Point attributed the campaign to Chinese actors based on the tactics deployed and the use of Alibaba Cloud and Tencent hosting tools.TencentCheck Point attributed the campaign to Chinese actors based on the tactics deployed and the use of Alibaba Cloud and Tencent hosting tools.TrueConfA high-severity bug (CVE-2026-3502) in the TrueConf video conferencing tool is being actively exploited, prompting CISA to order federal agencies to patch within two weeks.
Products
Tools
Industries
Critical infrastructureTrueConf is widely deployed by government, military, and critical infrastructure, raising potential impact.GovernmentTrueConf is widely deployed by government, military, and critical infrastructure, raising potential impact.MilitaryTrueConf is widely deployed by government, military, and critical infrastructure, raising potential impact.