Threat database

CVE-2026-108072 is a vulnerability in TSplus Remote Access version 19.20.3.10 caused by incorrect default permissions on shared login scripts (autostart1.tscr) in the shared themes directory. This misconfiguration allows users with valid sessions but insufficient privileges to modify these scripts. An attacker could exploit this to execute arbitrary commands under another user's security context upon login, potentially enabling lateral movement or privilege escalation depending on the targeted user's privileges.

CVE-2026-108071 is a high-severity authentication bypass vulnerability in TSplus Remote Access version 19.20.3.10. The flaw exists in the multi-factor authentication (MFA) mechanism, where the second-factor verification result is not properly enforced. An attacker with valid first-factor credentials can bypass the second-factor check and gain unauthorized access to protected applications and resources.

CVE-2026-108070 is a high-severity vulnerability in TSplus Remote Access version 19.20.3.10. It involves improper access control in the web server component, allowing unauthenticated remote attackers to bypass intended access restrictions and access internal resources by manipulating paths through the /socket.io/JWN/ endpoint.

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted. LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.

hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.