{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"TrueConf Server","source":"CNA: Kaspersky","vendor":"TrueConf","versions":[{"lessThan":"5.5.6","status":"affected","version":"4.7.2","versionType":"semver"}]}],"cveId":"CVE-2026-123040","cwes":["CWE-276"],"description":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: Kaspersky","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.8,"severity":"high","source":"CNA: Kaspersky","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794406536255,"publishedAt":1794405601991,"references":[{"source":"CNA: Kaspersky","tags":["third-party-advisory"],"url":"https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/"}],"remediation":[{"kind":"fix","source":"CNA: Kaspersky","text":"Update TrueConf Server (Linux) to versions 5.5.6 or newer."},{"kind":"workaround","source":"CNA: Kaspersky","text":"Perform a full check with anti-virus software that has up-to-date anti-virus databases and software modules."}],"revision":"b7f762bc5c0142c5c78a749ad625932430c75090856e51a3af89fa32be5c319c","sources":[{"modifiedAt":1794406536255,"name":"CNA: Kaspersky","retrievedAt":1794409724240,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123040"}],"ssvc":{"assessedAt":1794406527397,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-123040","updatedAt":1794409724240}