TSplus Remote Access: Multi-factor authentication bypass
Summary
TSplus Remote Access, software for remote access and publishing of Windows applications, has a flaw in its multi-factor authentication (MFA). An attacker with valid first-factor credentials can complete the login without a valid second-factor token and gain access to protected applications and resources. The attacker needs a valid username and password, so reused, leaked or sprayed passwords make the flaw exploitable. The CVSS v4.0 base score is 8.7 (High).
Affected
- TSplus Remote Access 19.20.3.10 (confirmed by INCIBE)
- Earlier versions may also be affected; not verified.
Fixed in
- Fixed by the TSplus team in the latest version.
- Exact fixed version number: Unknown.
Workaround
- No vendor-confirmed workaround.
- Generic mitigation: place the gateway behind a VPN or a zero-trust reverse proxy that enforces its own MFA before traffic reaches the TSplus login page.
Exploitation
- INCIBE lists no known exploitation.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept found; treat as unknown rather than confirmed absent.
Our recommendation
- Confirm the installed TSplus version and update to the latest release; ask TSplus support for the exact fixed build.
- Restrict access to the gateway via VPN or an MFA-enforcing proxy, especially for internet-exposed servers.
- Review authentication logs for successful logins without an MFA challenge or MFA success event.
- Enforce strong, unique passwords and monitor for password spraying.
- Also review CVE-2026-108070 from the same INCIBE notice, which affects the web server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-741: Multiple vulnerabilities in TSplus Remote Access www.incibe.es
- CVE record CVE-2026-108071 (CVE List V5) raw.githubusercontent.com
- SentinelOne vulnerability database: CVE-2026-108071 www.sentinelone.com
- VulDB entry for CVE-2026-108071 vuldb.com
- Strix: CVE-2026-108071 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:06.
Original description (NVD)
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.