CVE-2026-3502

What is CVE-2026-3502?

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Timeline

• 2026-03-30Published to the U.S. National Vulnerability Database (NVD)
• 2026-04-01First covered in a defend.network daily briefing
• 2026-04-02Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
• 2026-04-16CISA federal remediation deadline (BOD 22-01)
• 2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

TrueConf Client Download of Code Without Integrity Check Vulnerability

Affected product

TrueConf Client

References

• https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
• https://trueconf.com/blog/update/trueconf-8-5
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502
• https://nvd.nist.gov/vuln/detail/CVE-2026-3502
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Referenced in our briefings & reports

• TrueConf zero-day exploited; North Korea Axios npm compromise (2026-04-01)

Related vulnerabilities

• CVE-2026-72529 – TrueConf Server (same vendor)
• CVE-2026-72530 – TrueConf Server (same vendor)
• CVE-2026-30612 (same weakness: CWE-494)