CVE-2026-3502
moderate-risk
Published 2026-03-30
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
Do I need to act?
~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10
High
ADJACENT_NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
References (3)
Third Party Advisory
https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-agai...
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-...
Get this data via API
curl -H "Authorization: Bearer YOUR_KEY" \
https://cyber.phasetransitions.ai/api/v1/cves/CVE-2026-3502
Free tier: 100 requests/day, no credit card.
40
/ 100
moderate-risk
Severity
24/34 · High
Exploitability
11/34 · Low
Exposure
5/34 · Minimal