CISA Includes TrueConf Security Flaw in KEV Catalog After Exploitation in the Wild

CISA added CVE-2026-3502 — a TrueConf Client “Download of Code Without Integrity Check” (CWE-494) that allows arbitrary code execution via tampered updates — to its Known Exploited Vulnerabilities list on April 2, 2026, citing evidence of in-the-wild exploitation and mandating federal remediation (patch by April 16, 2026) or discontinuation of the product until secured.