Vulnerability · Published Oct 14, 2026 · Assigned by INCIBE
CVE-2026-108071Improper Multi-Factor Authentication Validation Allows Authentication Bypass
High 8.7
In plain English
A high-severity security flaw in TSplus Remote Access from TSplus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TSplus | TSplus Remote Access | 19.20.3.10 |
Weakness: CWE-304 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N