CVE-2026-108071
HighCVSS 8.7Summary
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
Risk Assessment
The risk to the organization includes the possibility of unauthorized access to protected applications and resources by an attacker who only has the first authentication factor, which could lead to data confidentiality and integrity breach.
Recommendation
It is recommended to immediately update TSplus Remote Access to a patched version and review MFA configuration to ensure proper enforcement of the second factor.
Other vulnerabilities in TSplus Remote Access
See all- CVE-2026-108072Medium
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode.
- CVE-2026-108070High
A vulnerability in the TSplus Remote Access web server involves improper access control. An unauthenticated remote attacker can access internal resources by manipulating paths through the /socket.io/JWN/ endpoint, bypassing access restrictions.
Original NVD description (English source)
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS