# CVE-2026-3502

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

- Page: https://www.vulneraibility.com/cve/CVE-2026-3502
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2026-04-02; CISA due date 2026-04-16
- EPSS: 5.85%
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept (first 2026-04-04)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-03-31)
- Weakness: CWE-494
- Published: 2026-03-30

## Affected versions

- TrueConf TrueConf Client: affected TrueConf Client versions 8.1.0 through 8.5.2

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://trueconf.com/blog/update/trueconf-8-5
- [advisory] https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.