TSplus Remote Access: Improper access control exposes internal web resources
Summary
TSplus Remote Access, a remote access and application publishing software for Windows, contains an improper access control flaw in its web server. An unauthenticated remote attacker can manipulate paths via the /socket.io/JWN/ endpoint to reach internal resources that should be restricted. The CVSS vector indicates high confidentiality impact only, with no integrity or availability impact; exploitation requires no privileges or user interaction.
Affected
- TSplus Remote Access 19.20.3.10 (confirmed)
- Earlier versions may also be affected (range not determined)
Fixed in
- Unknown. INCIBE states the issue is fixed in the latest version of TSplus Remote Access; no specific fixed build has been named.
Workaround
- No vendor workaround documented.
- Restrict network access to the TSplus web server to trusted sources or VPN.
- Monitor web server logs for unusual requests to /socket.io/JWN/.
- A reverse proxy or WAF restricting requests to the affected path may help; these are general controls, not vendor-tested fixes.
Exploitation
- INCIBE lists exploitation as "No".
- Not listed in CISA KEV.
- No public proof of concept found for this CVE.
Our recommendation
- Identify all TSplus Remote Access servers, especially internet-facing ones, and their versions.
- Ask TSplus or your reseller which build fixes CVE-2026-108070, then upgrade and confirm the installed version is no longer 19.20.3.10.
- Until patched, limit access to trusted networks or VPN and review logs for /socket.io/JWN/ requests.
- Patch CVE-2026-108071 (MFA bypass) and CVE-2026-108072 (insecure permissions) in the same update cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-741 www.incibe.es
- SentinelOne vulnerability database: CVE-2026-108070 www.sentinelone.com
- Ionix threat center: CVE-2026-108070 www.ionix.io
- Strix: CVE-2026-108070 www.strix.ai
- TSplus Remote Access changelog insights.tsplus.net
- Positive Technologies PT-2026-114003 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:07.
Original description (NVD)
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.