HIGH Actively exploited CWE-494
CVE-2026-3502
TrueConf Client Update Integrity Verification Bypass
TrueConf·Client
7.8/ 10
CVSS 3.1
High severity
5.8%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 93% of all CVEs
Listed
CISA KEV catalog
- Added
- Apr 2, 2026
- Fix due
- Apr 16, 2026
- Ransomware
- Not known
Timeline
- Published
- Mar 30, 2026
- Updated
- Apr 3, 2026
- First covered
- Aug 8, 2026
- Latest story
- 3 months ago
Summary
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
CWE-494Download of Code Without Integrity Check.
Attack profile
Attack vectorAdjacent
ComplexityLow
PrivilegesHigh
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:LCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- TrueConf ClientTrueConf Client versions 8.1.0 through 8.5.2