CISA Adds TrueConf Vulnerability to KEV Catalog Following Active Exploitation

CISA has added CVE-2026-3502 — a TrueConf Client “Download of Code Without Integrity Check” vulnerability enabling arbitrary code execution when updates are tampered with — to its Known Exploited Vulnerabilities catalog, citing active exploitation and requiring federal agencies to remediate by April 16, 2026; organizations are advised to apply vendor mitigations, update or discontinue the product if patches are unavailable.