Two entries added the same day drew due dates three days and 14 days out — missing authentication and code injection in TrueConf Server

1Same day, same product, different deadlines

Every entry in the CISA Known Exploited Vulnerabilities catalog carries its own due date, and two entries for the same product added on the same day show clearly that these are not uniform. TrueConf Server CVE-2026-72529 and CVE-2026-72530 were both added on 2026-08-20. The first is due three days later; the second, 14.

2The two side by side

The port used for access is the same, and both are described as usable remotely without authorization. That the grace periods still differ suggests due dates are not decided by a simple ranking of severity. Spread of exploitation, availability of mitigations and difficulty of remediation are among the conditions such a value plausibly reflects.

3Placing them in the distribution

Across the 1,687 KEV records this site holds as of 2026-09-02, the grace period from date added to due date has a median of 21 days, a minimum of 1 and a maximum of 184. Both of these entries fall below the median, and three days is a sharply compressed instruction. Fourteen days, by contrast, sits near a monthly maintenance cycle and can be handled within ordinary operations. Two entries arriving the same day still call for different movements.

4Adjacent numbers, separate handling

Vulnerabilities with nearly consecutive CVE numbers often emerge together from one investigation or one report. In the catalog, though, they are separate entries managed against separate deadlines. From an operations standpoint that means checking due dates entry by entry rather than batching by number proximity.

The required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use. Verify applicability with official vendor information and your own environment.