{"id":"CVE-2026-123040","aliases":[],"cve":{"records":[{"id":"CVE-2026-123040","source":"Kaspersky","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-05T07:33:05.167Z","published":"2026-11-11T14:00:01.991Z","modified":"2026-11-12T04:56:21.339Z"}],"publishers":[{"name":"Kaspersky","role":"CNA","organizationId":"e45d732a-8f6b-4b6b-be76-7420f6a2b988","modified":"2026-11-11T14:00:01.991Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T04:56:21.339Z"}],"references":[{"url":"https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/","tags":["third-party-advisory"],"source":"Kaspersky"}],"weaknesses":[{"id":"CWE-276","description":"CWE-276: Incorrect Default Permissions","source":"Kaspersky"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-11T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6…","titleSource":"Kaspersky","descriptionSource":"Kaspersky","description":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.","score":8.5,"severity":"high","published":"2026-11-11T14:00:01.991Z","modified":"2026-11-12T04:56:21.339Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"TrueConf","name":"TrueConf Server","platforms":["Linux"],"versions":[{"version":"4.7.2","status":"affected","lessThan":"5.5.6","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Kaspersky","url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"}],"remediation":[{"text":"Update TrueConf Server (Linux) to versions 5.5.6 or newer.","source":"Kaspersky","url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"},{"text":"Perform a full check with anti-virus software that has up-to-date anti-virus databases and software modules.","source":"Kaspersky","url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"}],"references":["https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/"],"sources":[{"name":"CVE","id":"CVE-2026-123040","modified":"2026-11-12T04:56:21.339Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"}],"assessments":[{"source":"Kaspersky","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5},{"source":"Kaspersky","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-12T07:53:57.208Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T14:40:35.627Z","attemptedAt":"2026-11-11T14:40:35.627Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-11T14:40:35.374Z","attemptedAt":"2026-11-11T14:40:35.374Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-11T14:40:35.393Z","attemptedAt":"2026-11-11T14:40:35.393Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-11T14:40:34.915Z","attemptedAt":"2026-11-11T14:40:34.915Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123040","modified":"2026-11-11T14:17:32.280","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-11T14:40:35.627Z"},{"source":"NVD","id":"CVE-2026-123040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123040","modified":"2026-11-11T14:17:32.280","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-11T14:40:35.627Z"}],"aiSummary":{"text":"TrueConf Server (Linux) versions 4.7.2 to 5.5.6 (excluding 5.5.6) have a weakness that allows an attacker with code execution ability to elevate privileges to root. The attacker must first exploit another vulnerability to run as the user trueconf. This is due to incorrect default permissions (CWE-276).","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T14:41:06.894Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"}]}}