Loading vulnerability…
CVE-2026-3502 is a vulnerability in the TrueConf Client update mechanism in which the client downloads and applies application updates without properly verifying the integrity and authenticity of the update package. The flaw affects the trusted update flow used with centrally managed or on-premises TrueConf deployments, allowing a malicious or compromised update source to substitute a trojanized package for a legitimate client update. Because the updater accepts the tampered payload as a valid update, the malicious package can be executed or installed in the context of the updating process or logged-in user. Reporting indicates the issue was exploited in the wild as a zero-day and was patched in the TrueConf Windows client starting with version 8.5.3.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a standalone Python exploit toolkit for a claimed TrueConf Windows update hijacking issue, CVE-2026-3502. It is not tied to a common exploit framework. The structure contains four main code files: `exploit.py` (primary exploit simulation and reporting), `detectors/vulnerability_checker.py` (server/client/IOC checker), `malicious_update_builder.py` (builder for a malicious update package using generated C stubs and an Inno Setup script), and `update_server.py` (Flask-based fake update server for MITM or server-compromise simulation). Supporting files include `README.md`, usage notes, requirements, and an example output file. Main exploit capability: `exploit.py` checks whether a target exposes `/downlods/trueconf_client.exe` and treats missing `ETag`/`Last-Modified` headers as evidence of weak integrity protection. It can then simulate an attack by validating a supplied malicious EXE, hashing it, printing deployment steps, and generating a JSON report. It does not automatically compromise the target server; instead, it operationalizes the attack workflow by documenting how to replace the server-hosted update binary in `C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_client.exe`. The builder component is more aggressive: `malicious_update_builder.py` generates source for a DLL sideload payload (`7z-x64.dll`), an Inno Setup installer script, and decoy binaries. The generated installer script drops files under `C:\ProgramData\PowerISO`, launches a client binary, adds persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UpdateCheck`, and creates a scheduled task `TrueConfUpdate`. The DLL payload is demonstrative but includes a proof action writing `C:\ProgramData\pwned.txt`; comments reference downloading a Havoc payload from `http://attacker.com/havoc.exe`. `update_server.py` provides a fake TrueConf server with routes `/downlods/trueconf_client.exe`, `/config`, `/version.js`, and `/`, allowing an operator to serve a malicious update and spoof version metadata to clients. `detectors/vulnerability_checker.py` performs HEAD requests to the update endpoint, checks local Windows install paths for vulnerable client versions, and looks for IOC artifacts such as dropped files, Run keys, and scheduled-task references. Overall, this is an operational proof-of-concept repository for malicious update delivery in a Windows enterprise/internal-network scenario. It combines vulnerability checking, fake infrastructure, payload packaging, and deployment guidance. While some actions are simulated and several payload steps are instructional rather than fully automated, the repository clearly aims to demonstrate arbitrary code execution through update hijacking and includes persistence-oriented payload examples.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity TrueConf Client vulnerability exploited as a zero-day in a separate campaign targeting Southeast Asian government entities.
A TrueConf zero-day arbitrary file execution vulnerability reportedly used in a separate campaign to compromise users via trojanized client updates.
A zero-day arbitrary file execution vulnerability in TrueConf reportedly exploited to compromise users via trojanized client updates in a separate campaign.
A critical TrueConf Client vulnerability caused by improper integrity/authenticity verification of software updates, enabling attackers to substitute malicious updates and achieve arbitrary code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.