CVE-2026-3502
Download of Code Without Integrity Check in TrueConf Client. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 2 April 2026.
- Product
- TrueConf Client
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
More from TrueConf this year.
- CVE-2026-72530 Code Injection, added
- CVE-2026-72529 Missing Authentication for Critical Function, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.