CVE-2026-108071 Details
Description
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
A vulnerability has been identified in the multi-factor authentication (MFA) mechanism of TSplus Remote Access, version 19.20.3.10. This vulnerability allows a remote attacker, authenticated with valid first-factor credentials, to bypass the second-factor verification. The issue arises because the authentication flow fails to properly apply the MFA validation result, enabling the attacker to complete the login process without a valid second-factor token. As a result, the attacker can gain access to protected applications and resources.
Users are advised to update to the latest version of TSplus Remote Access, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tsplus-remote-access | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-304 | Missing Critical Step in Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TSplus Remote Access | 19.20.3.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |