Loading story…
Multiple vulnerabilities in TrueConf Server were disclosed as affecting Windows deployments, including a high-severity authentication bypass tracked as BDU:2025-10114. The flaw stems from an alternative path or channel weakness (CWE-228) that allows remote attackers to send certain API requests without proper authentication, including access to some /admin/* endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that exploit code exists, and that the vulnerability has been observed in attacks.
A related TrueConf Server issue, BDU:2025-10115, allows attackers to read arbitrary files on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both BDU:2025-10114 and BDU:2025-10115 as trending vulnerabilities, while a third identifier, BDU:2025-10116, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Positive Technologies reported TrueConf Server vulnerabilities BDU-2025-10114 and BDU-2025-10115 as trending. BDU-2025-10114 involves insufficient access control on certain /admin/* endpoints, while BDU-2025-10115 allows arbitrary file read; in both cases, users were advised to apply the vendor's latest updates.
A high-severity authentication bypass vulnerability affecting multiple TrueConf Server for Windows versions prior to vendor-fixed releases was identified and confirmed by the vendor. The flaw allows remote attackers to send certain API requests without proper authentication, and the entry states exploit code exists and the vulnerability is being used in attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A zero-day flaw in the TrueConf Windows client, tracked as **`CVE-2026-3502`** and rated **CVSS 7.8**, was exploited in the wild to compromise government entities in Southeast Asia. Researchers said the vulnerability stemmed from missing integrity and authenticity checks in TrueConf’s update validation process, allowing anyone who controlled an on-premises TrueConf server to replace legitimate client updates with arbitrary executables delivered through the trusted update channel. In the campaign dubbed **TrueChaos**, attackers used a weaponized TrueConf update to install malware while still performing a legitimate software upgrade, then dropped files including **`poweriso.exe`** and a malicious **`7z-x64.dll`** for DLL sideloading. The intrusion reportedly involved persistence, privilege escalation, reconnaissance, hands-on-keyboard activity, and retrieval of additional payloads, with researchers assessing that the operation likely aimed to deploy the **Havoc** command-and-control framework and was linked with moderate confidence to a Chinese-nexus threat actor. TrueConf released a fix in Windows client version **8.5.3**.
Jun 29, 2026
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026