CVE-2026-3502

CISA KEV

Published April 2, 2026 · Updated April 3, 2026

high

What This Means

# CVE-2026-3502: TrueConf Client Unsigned Update Delivery TrueConf Client's update mechanism downloads code without verifying its integrity or authenticity, allowing an attacker positioned on the network path (via MITM, DNS hijacking, or compromised update server) to inject malicious code into update packages. If a user installs a tampered update, the attacker gains arbitrary code execution with the privileges of the TrueConf process or the installing user. **Action:** Immediately audit your TrueConf Client deployment. Apply any available patches from TrueConf. Implement network controls to restrict update traffic to legitimate TrueConf servers only, enforce HTTPS pinning if supported, and monitor for unusual update-related process execution. Consider isolating TrueConf endpoints until patched if you operate in a high-threat environment.

Official Description+

TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Affected Products

Vendor	Product
TrueConf	Client

Patch Status

Patch by 2026-04-16

Recommended Actions

Check if your systems use any of the affected products listed above.
Apply vendor patches immediately if available.
This vulnerability is in CISA's Known Exploited Vulnerabilities catalog — prioritize remediation.
Monitor vendor advisories for updates and additional mitigations.
Review logs for indicators of compromise related to CVE-2026-3502.

Related Coverage

Vvulnerability

CVE-2026-3502: TrueConf Client Update Mechanism Allows Arbitrary Code Execution via Unsigned Payload Injection

CVE-2026-3502 is a CWE-494 vulnerability in TrueConf Client where the update mechanism downloads and executes code without verifying integrity or authenticity. An attacker who can intercept or redirect update traffic via MITM, DNS hijacking, or a compromised update server can inject a malicious payload and achieve arbitrary code execution on affected endpoints. CISA has added this vulnerability to the KEV catalog with a federal agency patch deadline of April 16, 2026.

CISA KEV·1d ago·3 min read