CVE-2026-108071: 
TSplus Remote Access vulnerability analysis and mitigation

CVE-2026-108071 is an incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism, classified as an MFA bypass. A remote attacker who has already authenticated with valid first-factor credentials can bypass the second-factor verification step entirely, because the authentication flow does not correctly apply the MFA validation result. The vulnerability affects TSplus Remote Access version 19.20.3.10 and was disclosed on October 14, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, INCIBE).

The root cause is classified as CWE-304 (Missing Critical Step in Authentication): the authentication flow processes the MFA validation result but fails to enforce it, allowing the login sequence to proceed to completion regardless of whether the second factor was successfully verified (GitHub Advisory). The attack vector is network-based with low attack complexity and no special attack requirements, meaning an attacker only needs valid first-factor (username/password) credentials to exploit the flaw — no user interaction or elevated privileges beyond a standard account are required. No public proof-of-concept code has been identified at the time of disclosure (Feedly).

Successful exploitation allows an attacker with valid first-factor credentials to fully bypass MFA and gain unauthorized access to all applications and resources protected by the TSplus Remote Access portal. The CVSS v4.0 scoring reflects high impact to confidentiality, integrity, and availability of the vulnerable system, meaning an attacker could read sensitive data, modify resources, and potentially disrupt service availability. Depending on what applications are published through TSplus Remote Access, this could enable lateral movement into internal networks or access to sensitive business systems (GitHub Advisory, INCIBE).

As of the disclosure date (October 14, 2026), there is no evidence of active in-the-wild exploitation and no public proof-of-concept has been published (Feedly). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low exploitation complexity (valid credentials required, no other prerequisites) means the risk could escalate quickly if credentials are compromised or if the vulnerability is weaponized (INCIBE).

1. Credential Acquisition: Obtain valid first-factor credentials (username and password) for a TSplus Remote Access account through phishing, credential stuffing, or purchase from underground markets.
2. Initiate Authentication: Navigate to the TSplus Remote Access login portal and submit the valid username and password to complete the first authentication factor.
3. Bypass MFA Step: When prompted for the second-factor token (e.g., TOTP code), submit an invalid, empty, or arbitrary value. Due to the authentication flow flaw (CWE-304), the server does not correctly enforce the MFA validation result.
4. Gain Unauthorized Access: The server completes the login sequence despite the failed MFA check, granting the attacker full access to the protected applications and resources available to the compromised account (GitHub Advisory, INCIBE).

• Logs: Authentication logs showing successful login completions for accounts where the MFA step was submitted with an invalid or empty token value; look for login events where the MFA validation step is recorded as failed but the session is still established.
• Logs: Multiple login attempts from unfamiliar IP addresses that successfully authenticate despite MFA being enabled on the account.
• Network: Unexpected access to TSplus Remote Access from geographic locations or IP ranges inconsistent with the legitimate user's normal behavior.
• Logs: Access to sensitive published applications immediately following a login event with anomalous MFA token submission patterns.

Users should update TSplus Remote Access to a version beyond 19.20.3.10, which is the confirmed vulnerable version; consult the TSplus vendor advisory for the specific patched release number (INCIBE). As interim compensating controls, administrators should implement IP allowlisting to restrict TSplus Remote Access to known trusted IP ranges, and monitor authentication logs for suspicious patterns such as successful logins with failed MFA token submissions. Consider temporarily disabling external access to the TSplus portal until patching is complete if the risk exposure is deemed unacceptable.

The vulnerability was coordinated and disclosed by INCIBE-CERT (Spain's national cybersecurity incident response team), which published a notice covering multiple vulnerabilities in TSplus Remote Access (INCIBE). No notable independent researcher commentary, social media discussion, or significant media coverage has been identified at the time of this report.