CVE-2026-108070: 
TSplus Remote Access vulnerability analysis and mitigation

CVE-2026-108070 is an improper access control vulnerability in the TSplus Remote Access web server that allows unauthenticated remote attackers to access internal resources by manipulating paths through the /socket.io/JWN/ endpoint, bypassing intended access restrictions. The vulnerability was disclosed on October 14, 2026, and is classified under CWE-552 (Files or Directories Accessible to External Parties). It affects TSplus Remote Access version 19.20.3.10, with the default status for other versions listed as unaffected. The vulnerability carries a CVSS v4.0 base score of 8.7 (High), assigned by INCIBE (GitHub Advisory, INCIBE).

The root cause is improper access control (CWE-552), where the TSplus Remote Access web server fails to properly enforce access restrictions on internal resources when requests are routed through the /socket.io/JWN/ endpoint using manipulated paths. An unauthenticated attacker can craft HTTP requests that traverse or manipulate the path component of this endpoint to reach resources that should be protected from external access. No authentication, user interaction, or special preconditions are required — the attack is network-accessible with low complexity. The vulnerability is associated with CAPEC-150 (Collect Data from Common Resource Locations) and CAPEC-639 (Probe System Files), suggesting the primary risk is unauthorized file or directory enumeration and access (GitHub Advisory, INCIBE).

Successful exploitation allows an unauthenticated remote attacker to access internal resources that should be restricted, resulting in a high confidentiality impact on the vulnerable system. There is no integrity or availability impact reported. Exposed resources could include sensitive configuration files, credentials stored in files (MITRE ATT&CK T1552.001), or data accessible from network shared drives (T1039), potentially enabling further lateral movement or privilege escalation within the environment (GitHub Advisory, INCIBE).

As of the disclosure date (October 14, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The NVD SSVC assessment classifies the vulnerability as automatable with partial technical impact and no known exploitation. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, INCIBE).

1. Reconnaissance: Identify internet-facing TSplus Remote Access instances (version 19.20.3.10) using tools such as Shodan or Censys by searching for TSplus-specific HTTP response headers or default web interface characteristics.
2. Identify the vulnerable endpoint: Confirm the presence of the /socket.io/JWN/ endpoint by sending a baseline HTTP GET or POST request to the target server.
3. Craft a path manipulation request: Construct an HTTP request targeting the /socket.io/JWN/ endpoint with a manipulated path component designed to reference internal resources that would normally be access-controlled (e.g., /socket.io/JWN/../<internal-resource>).
4. Access restricted resources: Submit the crafted request without any authentication credentials. If the server fails to validate the path, it will serve the requested internal resource, potentially exposing configuration files, credentials, or other sensitive data.
5. Exfiltrate or leverage exposed data: Use any retrieved credentials or configuration details for further access, lateral movement, or privilege escalation within the target environment (GitHub Advisory, INCIBE).

• Network: Unusual or repeated HTTP requests to /socket.io/JWN/ with path traversal sequences (e.g., ../, %2e%2e%2f) or unexpected resource paths from external/untrusted IP addresses; high volume of unauthenticated requests to this endpoint.
• Logs: Web server access logs showing requests to /socket.io/JWN/<unexpected-path> returning HTTP 200 responses for resources not normally served externally; requests from a single IP to multiple internal resource paths in rapid succession (consistent with automated collection, T1119).
• File System: Evidence of access to sensitive files (e.g., configuration files, credential stores) that should not be externally reachable, reflected in file access timestamps or audit logs.

Organizations should contact TSplus directly for security updates, as no official patch version has been publicly identified beyond the affected version 19.20.3.10. As interim mitigations, restrict network-level access to the /socket.io/JWN/ endpoint using firewall rules or reverse proxy ACLs to allow only trusted IP ranges. Deploy Web Application Firewall (WAF) rules to detect and block path traversal and manipulation attempts targeting this endpoint. Monitor server logs for suspicious unauthenticated access patterns to the affected endpoint (INCIBE, GitHub Advisory).