Incorrect Authentication Vulnerability in TSplus Remote Access by TSplus
CVE-2026-108071

8.7HIGH

Key Information:

Vendor

Tsplus

Status
Tsplus Remote Access
Vendor
CVE Published:
14 October 2026

What is CVE-2026-108071?

A serious flaw in the TSplus Remote Access multi-factor authentication (MFA) mechanism allows remote attackers with valid first-factor credentials to bypass the second-factor verification. This vulnerability occurs due to an incorrect implementation in the authentication flow, which fails to properly validate the second-factor result. As a result, attackers can log in without a valid second-factor token, gaining unauthorized access to sensitive applications and resources.

Affected Version(s)

TSplus Remote Access 19.20.3.10

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Javier Medina Munuera
.