Two products, one attacker, one patch window
A hacktivist group tracked as Head Mare is actively exploiting vulnerabilities in two unrelated pieces of server software - TrueConf Server, a self-hosted video-conferencing platform, and Zimbra Collaboration Suite, a widely used email and groupware system. The US Cybersecurity and Infrastructure Security Agency (CISA) added flaws in both products to its Known Exploited Vulnerabilities (KEV) catalog within days of each other, and the compliance deadlines for federal civilian agencies land in the same week.
The overlap is not a coincidence in the sense of shared code - TrueConf and Zimbra are built by different vendors and serve different purposes. What connects them is the attacker: security researchers at Kaspersky have tied exploitation of both flaws to the same campaign, which drops a malware payload called PhantomCore onto compromised servers.
What is broken in TrueConf
TrueConf Server, sometimes described in coverage as a Russian-built alternative to Zoom, shipped with two flaws, now tracked under Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-72529 and CVE-2026-72530. The first lets a remote attacker with no credentials at all invoke an undocumented function over the server's network port to run arbitrary scripts. The second is a sandbox-escape bug: code that should be confined to an isolated environment on the server can instead break out and run commands directly on the host operating system. Chained together, an outsider with network access can go from zero footholds to full control of the underlying machine.
TrueConf shipped fixes in June 2026, in versions 5.3.9, 5.4.9 and 5.5.5. Head Mare has been exploiting the pre-patch versions since at least July, according to Kaspersky's writeup, by trojanizing the client installers that TrueConf servers distribute to their own users - so a victim connecting to a compromised video-conferencing server can end up running a backdoored installer themselves.
What is broken in Zimbra
The second flaw, CVE-2026-73570, carries a severity score of 8.9 out of 10 and affects Zimbra Collaboration Suite before version 10.1.20. It requires the optional zimbra-snmp package to be installed with Simple Network Management Protocol (SNMP) notifications turned on - a non-default configuration, but not an unusual one for organizations that monitor their mail servers centrally. An attacker who meets that precondition can trigger command injection through a crafted Simple Mail Transfer Protocol (SMTP) request, again without needing valid credentials first.
Zimbra shipped the fix on July 20, 2026. Poland's national Computer Emergency Response Team (CERT) was the first to publicly flag active in-the-wild exploitation, and CISA's own deadline for US federal agencies to patch this specific flaw falls on August 24 - effectively immediate by the time most organizations read about it.
Who is behind it and who they target
Head Mare has operated since 2023 and has historically focused on organizations inside Russia and Belarus, spanning transportation, energy, IT and software development. That geographic and sectoral focus is worth noting for readers outside those regions: the campaign is real and the underlying vulnerabilities are exploitable by anyone, but the observed targeting so far skews toward a specific set of victims rather than opportunistic mass scanning.
The group's toolkit in this campaign extends past PhantomCore. Kaspersky's researchers documented web-shell deployment through file replacement, distribution of malicious client installers, and Unix-based backdoors that use the TrueConf protocol itself alongside GitHub for command-and-control - a choice that lets malicious traffic blend in with legitimate developer activity on a platform most network monitoring tools do not flag by default.
Why the KEV listing matters beyond US agencies
CISA's KEV catalog is a US federal compliance mechanism, and its binding deadlines apply only to federal civilian agencies. But the catalog functions as a de facto global signal: a listing means CISA has verified active exploitation, not just theoretical risk, and it is one of the most reliable free indicators available to any organization deciding what to patch first with limited staff. Security teams running either product, regardless of jurisdiction, should treat both flaws as already being used against real targets rather than as advisories to schedule for later.
What this means in practice
Organizations running TrueConf Server should confirm they are on 5.3.9, 5.4.9 or 5.5.5 or later, and should treat any client installer distributed by the server before that update as suspect. Zimbra administrators should check whether the zimbra-snmp package is installed and SNMP notifications are enabled; if so, updating to 10.1.20 is not optional. Both fixes have been available for over a month, which means any server still unpatched has been exposed for the entire window Head Mare has been actively exploiting it.
Sources
This article draws on reporting from BleepingComputer, SecurityWeek, The Hacker News, Security Affairs, The Register and CISA's own KEV catalog advisory.
