CVE-2026-108072: 
TSplus Remote Access vulnerability analysis and mitigation

CVE-2026-108072 is an incorrect default permissions vulnerability in TSplus Remote Access affecting the shared login script files (autostart1.tscr) located in the shared themes directory. A local attacker with a valid session on the terminal or remote desktop server can write to these files and execute arbitrary commands within another user's security context upon that user's next login. The vulnerability affects TSplus Remote Access version 19.20.3.10 and was disclosed on October 14, 2026, by INCIBE-CERT. It carries a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, INCIBE Advisory).

The root cause is CWE-276 (Incorrect Default Permissions): the autostart1.tscr script files in the shared themes directory are installed with overly permissive write access, allowing low-privileged users to modify them. When a victim user logs in using the same theme or operating mode, the modified autostart script executes automatically within that user's security context. Exploitation requires the attacker to have a valid local or remote desktop session on the affected server, and the victim must subsequently log in — making user interaction a prerequisite. No public proof-of-concept code has been identified at this time (GitHub Advisory, INCIBE Advisory).

Successful exploitation allows a local attacker to execute arbitrary commands within another user's security context, enabling lateral movement between users sharing the same theme or operating mode. If the targeted user holds elevated privileges (e.g., administrator), the attacker can achieve full privilege escalation on the terminal or remote desktop server. The vulnerable system impact includes high confidentiality, integrity, and availability consequences for the affected user's session and data (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-108072. The EPSS score is 0.0, and the NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid local session and passive user interaction (victim must log in), limiting the attack surface (GitHub Advisory, INCIBE Advisory).

1. Gain Initial Access: Obtain a valid low-privileged user session on the TSplus Remote Access terminal or remote desktop server (e.g., via legitimate credentials or a compromised account).
2. Identify Target Files: Locate the shared themes directory containing autostart1.tscr files (e.g., within the TSplus installation path under shared themes). Confirm write access using file permission enumeration tools such as icacls (Windows) or ls -la (Linux).
3. Select Target User: Identify a higher-privileged user who shares the same theme or operating mode, using session enumeration or user listing commands.
4. Modify the Autostart Script: Append or replace content in the writable autostart1.tscr file with a malicious payload (e.g., a command to add the attacker to an admin group, create a backdoor account, or exfiltrate credentials).
5. Wait for Victim Login: Wait for the targeted user to log in using the same theme or operating mode, which triggers automatic execution of the modified autostart1.tscr script within their security context.
6. Achieve Objective: The injected commands execute with the victim's privileges, enabling privilege escalation (if the victim is an admin) or lateral movement to access the victim's data and resources (GitHub Advisory, INCIBE Advisory).

• File System: Unexpected or unauthorized modifications to autostart1.tscr files in the TSplus shared themes directory; file timestamps on autostart1.tscr that do not align with legitimate administrative changes; presence of unusual commands or scripts appended to autostart files.
• Logs: Windows Security Event logs showing file write operations to the shared themes directory by non-administrative users (Event ID 4663); TSplus session logs showing script execution at login for users who did not initiate the change.
• Process: Unexpected processes spawned during user login sessions (e.g., cmd.exe, powershell.exe, net.exe) as child processes of the TSplus login/autostart mechanism; unusual network connections initiated shortly after a user login event.
• User Activity: New local accounts created or privilege group membership changes (e.g., Administrators group) coinciding with user login events on the RDS server (GitHub Advisory).

The GitHub Advisory Database lists the vulnerability as patched, though specific fixed version numbers have not been publicly detailed. Administrators should immediately restrict write permissions on autostart1.tscr files in the shared themes directory to administrators only, using icacls or equivalent tools. Audit existing autostart script files for unauthorized modifications and review file permission configurations across all shared TSplus directories. If autostart scripts are not operationally required, consider disabling them entirely. Organizations should monitor TSplus vendor communications for an official patch release and apply it promptly (GitHub Advisory, INCIBE Advisory).