← CVE Radar
CVE-2026-3502TrueConf Client Update Integrity Verification Bypass
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
7.8 HIGHEPSS 5.84%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1checkpoint (CNA) | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L |
CISA required action
⚡ Known exploited · remediation due Apr 16, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2026-3502
- Status
- Analyzed
- Assigner (CNA)
- checkpoint
- Published
- Mar 30, 2026
- Last modified
- 2026-06-17 10:43 UTC
- Weaknesses
- CWE-494 · Download of Code Without Integrity Check.
Affected Products
As published by the CNA in the CVE record.
TrueConfTrueConf Client1 version range
- TrueConf Client versions 8.1.0 through 8.5.2