CVE-2026-3502
Published 2026-03-30 · Updated 2026-06-17 · Source cve@checkpoint.com
Summary
CVE-2026-3502 is a high-severity (CVSS 7.8) vulnerability in TrueConf Client. CISA added it to the Known Exploited Vulnerabilities catalog on April 2, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 16, 2026. CISA does not currently list it as used in ransomware campaigns. TrueConf has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 3 known-exploited TrueConf vulnerabilities →Description
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
CISA Known-Exploited Vulnerability
Product: TrueConf — Client
Name: TrueConf Client Download of Code Without Integrity Check Vulnerability
Date added: 2026-04-02 · Due: 2026-04-16
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.