Loading vulnerability…
CVE-2026-3502 is a CVSS 7.8 vulnerability in the TrueConf Windows Client update-validation mechanism. The client retrieves update packages from a centrally managed on-premises TrueConf Server and applies them without adequate integrity and authenticity validation. An attacker able to control or tamper with the update source can substitute a malicious package for the legitimate client update, which is then delivered through the trusted update workflow. The issue was exploited as a zero-day in Operation TrueChaos against Southeast Asian government entities.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a standalone Python exploit toolkit for a claimed TrueConf Windows update hijacking issue, CVE-2026-3502. It is not tied to a common exploit framework. The structure contains four main code files: `exploit.py` (primary exploit simulation and reporting), `detectors/vulnerability_checker.py` (server/client/IOC checker), `malicious_update_builder.py` (builder for a malicious update package using generated C stubs and an Inno Setup script), and `update_server.py` (Flask-based fake update server for MITM or server-compromise simulation). Supporting files include `README.md`, usage notes, requirements, and an example output file. Main exploit capability: `exploit.py` checks whether a target exposes `/downlods/trueconf_client.exe` and treats missing `ETag`/`Last-Modified` headers as evidence of weak integrity protection. It can then simulate an attack by validating a supplied malicious EXE, hashing it, printing deployment steps, and generating a JSON report. It does not automatically compromise the target server; instead, it operationalizes the attack workflow by documenting how to replace the server-hosted update binary in `C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_client.exe`. The builder component is more aggressive: `malicious_update_builder.py` generates source for a DLL sideload payload (`7z-x64.dll`), an Inno Setup installer script, and decoy binaries. The generated installer script drops files under `C:\ProgramData\PowerISO`, launches a client binary, adds persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UpdateCheck`, and creates a scheduled task `TrueConfUpdate`. The DLL payload is demonstrative but includes a proof action writing `C:\ProgramData\pwned.txt`; comments reference downloading a Havoc payload from `http://attacker.com/havoc.exe`. `update_server.py` provides a fake TrueConf server with routes `/downlods/trueconf_client.exe`, `/config`, `/version.js`, and `/`, allowing an operator to serve a malicious update and spoof version metadata to clients. `detectors/vulnerability_checker.py` performs HEAD requests to the update endpoint, checks local Windows install paths for vulnerable client versions, and looks for IOC artifacts such as dropped files, Run keys, and scheduled-task references. Overall, this is an operational proof-of-concept repository for malicious update delivery in a Windows enterprise/internal-network scenario. It combines vulnerability checking, fake infrastructure, payload packaging, and deployment guidance. While some actions are simulated and several payload steps are instructional rather than fully automated, the repository clearly aims to demonstrate arbitrary code execution through update hijacking and includes persistence-oriented payload examples.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day arbitrary file execution vulnerability in TrueConf exploited in a separate April 2026 campaign to compromise users through trojanized client updates.
Another TrueConf vulnerability reportedly exploited as a zero-day in Operation True Chaos to compromise users via trojanized client updates.
A high-severity TrueConf Client vulnerability exploited as a zero-day in a separate campaign targeting Southeast Asian government entities.
A TrueConf zero-day arbitrary file execution vulnerability reportedly used in a separate campaign to compromise users via trojanized client updates.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.