CVE-2026-108071
Received
Received - Intake
TSplus Remote Access MFA Authentication Bypass
Vulnerability report for CVE-2026-108071, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TSplus | TSplus | Remote Access 19.20.3.10 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-304 | The product implements an authentication technique, but it skips a step that weakens the technique. |
