Multiple vulnerabilities in TSplus Remote Access
Posted date 14/10/2026
Identificador
INCIBE-2026-741
Importance
4 - High
Affected Resources
TSplus Remote Access, version 19.20.3.10. It has been confirmed that this version is affected, although other earlier versions may also be affected.
Description
INCIBE has coordinated the disclosure of three vulnerabilities: two high-severity and one medium-severity that affect TSplus Remote Access by TSplus, a remote access and Windows application publishing software that allows users to connect to desktops and programs from anywhere and on any device. The vulnerabilities were discovered by Javier Medina Munuera.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type for each vulnerability:
- CVE-2026-108070: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-552
- CVE-2026-108071: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-287
- CVE-2026-108072: CVSS v4.0: 5.4 | CVSS AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-276
Solution
The vulnerabilities have been fixed by the TSplus team in the latest version.
Detail
- CVE-2026-108070: A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
- CVE-2026-108071: Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
- CVE-2026-108072: Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-108070 | Alta | No | TSplus |
| CVE-2026-108071 | Alta | No | TSplus |
| CVE-2026-108072 | Media | No | TSplus |
References list
Etiquetas
