What is CVE-2026-3502?

CVE-2026-3502 is a high-severity vulnerability in Trueconf, classified under Download of Code Without Integrity Check. CVSS score: 7.8/10. Published 2026-03-30.

How severe is CVE-2026-3502?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2026-3502 known to be exploited?

Yes. CVE-2026-3502 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-04-02), indicating it is being actively exploited. 2 public proof-of-concept repositories are indexed.

Vulnerability in Trueconf

CVE-2026-3502

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Published 2026-03-30 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L.

EPSS exploit prediction

EPSS: 0.003 (24.4th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.057 · newest: 0.003 · change: -0.054

Affected products

Trueconf
Trueconf Client — versions TrueConf Client versions 8.1.0 through 8.5.2

Weakness classification (CWE)

CWE-494 — Download of Code Without Integrity Check

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2026-04-02. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2026-04-16.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

trueconf.com/blog/update/trueconf-8-5 (Product, Release Notes)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (Third Party Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2026-3502?: CVE-2026-3502 is a high-severity vulnerability in Trueconf, classified under Download of Code Without Integrity Check. CVSS score: 7.8/10. Published 2026-03-30.
How severe is CVE-2026-3502?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2026-3502 known to be exploited?: Yes. CVE-2026-3502 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-04-02), indicating it is being actively exploited. 2 public proof-of-concept repositories are indexed.