CVE-2025-26318

TSplus Remote Access - CVE-2025-26318 Insecure Permissions Information Disclosure 📌 Description TSplus is, by default, vulnerable to the disclosure of information from users currently connected to the domain on TSplus. 🔍 Vulnerability Details CVE ID : CVE-2025-26318 Vendor : TSplus Affected...

CVE-2026-108071

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...

CVE-2026-108072

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

CVE-2026-108070

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2026-108072

The TSplus Remote Access software is vulnerable to a flaw caused by incorrect permissions in shared login scripts. Specifically, the autostart1.tscr files in the shared themes directory can be modified by users who lack sufficient privileges. A local attacker with a valid session on the terminal ...

CVE-2026-108072 Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

CVE-2026-108072 Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

EUVD-2026-100990

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...

CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...

EUVD-2026-100989

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...

CVE-2026-108071

The TSplus Remote Access software contains an incorrect authentication vulnerability within its multi-factor authentication (MFA) mechanism. A remote attacker who possesses valid first-factor credentials can bypass the second-factor verification because the authentication flow fails to correctly ...

CVE-2026-108070 Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2026-108070 Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2026-108070

The TSplus Remote Access web server is vulnerable to an improper access control flaw. This vulnerability allows an unauthenticated remote attacker to bypass intended access restrictions and reach protected internal resources by using manipulated paths via the /socket.io/JWN/ endpoint. Exploitatio...

EUVD-2026-100980

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2026-108071: Missing Critical Step in Authentication

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...

CVE-2026-108072: Incorrect Default Permissions

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

CVE-2026-108070: Files or Directories Accessible to External Parties

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2023-31068

An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILESX86%\TSplus\UserDesktop\themes...