TrueConf Client Vulnerability - Arbitrary Code Execution via Updates

CISA Known Exploited Vulnerabilities (KEV)

Published April 3rd, 2026

Detected April 3rd, 2026

Summary

CISA added CVE-2026-3502 to the Known Exploited Vulnerabilities catalog. The vulnerability allows remote attackers to execute arbitrary code via unverified software updates in TrueConf Client versions 8.1.0 through 8.5.2. The flaw has a CVSS score of 7.8 (HIGH) and is classified as actively exploited with total technical impact.

View original document View source feed page

What changed

CISA has cataloged CVE-2026-3502, a vulnerability in TrueConf Client software versions 8.1.0-8.5.2 where the application's update mechanism downloads code without performing integrity verification. An attacker who controls the update delivery path can substitute a malicious payload, achieving arbitrary code execution. The vulnerability is confirmed actively exploited in the wild (SSVC: active/no/total) with a CVSS 3.1 score of 7.8.

Organizations running TrueConf Client versions 8.1.0-8.5.2 must update to version 8.5.3 or later immediately. Federal civilian agencies are subject to BOD 22-01 requiring remediation of KEVs. As a best practice, organizations should disable automatic updates until patching is confirmed and audit update delivery mechanisms for signs of compromise.

What to do next

Update TrueConf Client to version 8.5.3 or later immediately
Disable automatic updates until patching is complete if unable to update immediately
Audit update delivery mechanisms and systems for indicators of compromise

Source document (simplified)

Required CVE Record Information

CNA: Check Point Software Technologies Ltd.

Description

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

CWE 1 Total

Learn more
- CWE-494: CWE-494: Download of Code Without Integrity Check.

CVSS 1 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 7.8 | HIGH | 3.1 | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L |

Product Status

Learn more Versions 1 Total

Default Status: unknown

affected

affected at TrueConf Client versions 8.1.0 through 8.5.2

References 1 Total

https://trueconf.com/blog/update/trueconf-8-5

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-04-03

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | total | 2.0.3 | 2026-03-31 |