CVE-2026-3502

7.8

HIGH CVSS 3.1

TrueConf Client Download of Code Without Integrity Check Vulnerability - [Actively Exploited]

Overview

Description

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Details

INFO

Published Date :

March 30, 2026, 7:16 p.m.

Last Modified :

April 3, 2026, 11:40 a.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Apr 16, 2026

Alert Date: Apr 02, 2026 | 18 days ago

Description :

TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://trueconf.com/blog/update/trueconf-8-5 ; https://trueconf.com/downloads/windows.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3502

Impact

Affected Products

The following products are affected by CVE-2026-3502 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Trueconf	trueconf

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				897c38be-0345-43cd-b6cf-fe179e0c4f45
	CVSS 3.1	HIGH				[email protected]

Solution

Ensure all application updates are verified before installation to prevent arbitrary code execution.

Verify the integrity of downloaded update packages.
Implement digital signature checks for updates.
Ensure updates are delivered over secure channels.
Apply vendor patches when available.

Public PoC/Exploit Available at Github

CVE-2026-3502 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-3502.

URL	Resource
https://trueconf.com/blog/update/trueconf-8-5	Product Release Notes
https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-3502 is associated with the following CWEs:

CWE-494: Download of Code Without Integrity Check

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-3502 weaknesses.

CAPEC-184: Software Integrity Attack Software Integrity Attack CAPEC-185: Malicious Software Download Malicious Software Download CAPEC-186: Malicious Software Update Malicious Software Update CAPEC-187: Malicious Automated Software Update via Redirection Malicious Automated Software Update via Redirection CAPEC-533: Malicious Manual Software Update Malicious Manual Software Update CAPEC-538: Open-Source Library Manipulation Open-Source Library Manipulation CAPEC-657: Malicious Automated Software Update via Spoofing Malicious Automated Software Update via Spoofing CAPEC-662: Adversary in the Browser (AiTB) Adversary in the Browser (AiTB) CAPEC-691: Spoof Open-Source Software Metadata Spoof Open-Source Software Metadata CAPEC-692: Spoof Version Control System Commit Metadata Spoof Version Control System Commit Metadata CAPEC-693: StarJacking StarJacking CAPEC-695: Repo Jacking Repo Jacking

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

packet-noir/kev_rec

Retrieves CVEs added in the last N days from CISA's Known Exploited Vulnerability (KEV) database.

Python

Updated: 3 days, 3 hours ago

0 stars 0 fork 0 watcher

Born at : April 8, 2026, 1:52 a.m. This repo has been linked 3 different CVEs too.

fevar54/CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

Herramienta de detección para CVE-2026-3502. Escanea servidores TrueConf sin verificación de actualizaciones, detecta clientes Windows vulnerables (≤8.5.3.884) y busca IOCs de TrueChaos: PowerISO, persistencia en registro y tareas programadas. Reportes JSON, HTML o CSV.

Python

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 4, 2026, 10:50 p.m. This repo has been linked 1 different CVEs too.

fevar54/CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC

Exploit para CVE-2026-3502 en TrueConf Client. Un atacante con control del servidor TrueConf local reemplaza la actualización legítima por un payload malicioso sin verificación de integridad, logrando ejecución remota de código y despliegue de malware Havoc en todos los clientes conectados (Operación TrueChaos).

Python

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 4, 2026, 10:39 p.m. This repo has been linked 1 different CVEs too.

myseq/tracker

Security Tracker

Python

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 3, 2026, 11 a.m. This repo has been linked 5 different CVEs too.

CryptoGenNepal/CVE-KEV-RSS

CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.

cve json rss cgn cisa kev

Python HTML

Updated: 2 weeks, 2 days ago

7 stars 4 fork 4 watcher

Born at : Feb. 16, 2025, 5:21 p.m. This repo has been linked 1 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 2 weeks ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 11 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks ago

7620 stars 1243 fork 1243 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 766 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-3502 vulnerability anywhere in the article.

Daily CyberSecurity

Root Access at Risk: Critical Nix Sandbox Escape Overwrites Sensitive System Files

A severe security vulnerability has been identified in the Nix package manager, a tool celebrated by the Linux and Unix communities for making package management reliable and reproducible. Tracked as ...

Published Date: Apr 10, 2026 (1 week, 2 days ago)

Daily CyberSecurity

Critical Privilege Escalation in Checkmk: Root Access at Risk

A critical-severity security vulnerability has been identified in the Checkmk monitoring platform, potentially allowing local users to seize full control of the host system. The flaw, tracked as CVE-2 ...

Published Date: Apr 10, 2026 (1 week, 2 days ago)

Daily CyberSecurity

HPE Aruba Patches High-Severity Credential Theft Flaw

HPE Aruba Networking has issued an important software update to address a high-severity security flaw in its Private 5G Core On-Prem Platform. The vulnerability, tracked as CVE-2026-23818, could allow ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

TP-Link Archer AX53 Hit by Multiple High-Severity Vulnerabilities

TP-Link has issued an urgent security advisory regarding its Archer AX53 v1.0 router, detailing five distinct vulnerabilities that could allow attackers to seize control of the device or leak sensitiv ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Cloud Engineering at Risk: AWS Patches Critical Privilege Escalation and RCE Flaws in RES

Research and Engineering Studio on AWS architecture | Image: AWS Amazon Web Services (AWS) has released urgent security updates for its Research and Engineering Studio (RES), an open-source portal des ...

Published Date: Apr 09, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Denial of Service Alert: React Server Components Vulnerability Causes CPU Spikes

React, the popular JavaScript library used by millions of developers for building user interfaces, has issued an urgent advisory regarding a denial of service (DoS) vulnerability. The flaw specificall ...

Published Date: Apr 09, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Sandbox Escape: Critical Flatpak Flaw Grants Full Host Access

Flatpak, the widely-used system for building, distributing, and running sandboxed desktop applications on Linux, has been hit by a critical security vulnerability. The flaw, tracked as CVE-2026-34078 ...

Published Date: Apr 09, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Security Alert: GitLab Issues Patch for High-Severity Vulnerabilities Across CE and EE

GitLab has released critical security updates for Community Edition (CE) and Enterprise Edition (EE). Versions 18.10.3, 18.9.5, and 18.8.9 address multiple high and medium-severity flaws that could co ...

Published Date: Apr 09, 2026 (1 week, 4 days ago)

Daily CyberSecurity

The $86,000 Patch: Chrome 147 Crushes “Critical” WebML Memory Flaws

The Google Chrome team has officially promoted Chrome 147 to the stable channel for Windows, Mac, and Linux. This update, labeled version 147.0.7727.55/56, is a heavyweight release aimed at squashing ...

Published Date: Apr 09, 2026 (1 week, 4 days ago)

Daily CyberSecurity

CISA Warning: Critical Ivanti EPMM Code Injection Vulnerability Under Active Attack

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities ...

Published Date: Apr 09, 2026 (1 week, 4 days ago)

Daily CyberSecurity

High-Severity Patches: NVIDIA Secures DALI and Triton Inference Server

NVIDIA has released two significant security updates addressing high-severity vulnerabilities across its DALI and Triton Inference Server software. The patches fix critical flaws that could lead to ar ...