Read the docs
TI-2026-73983 Aliases CVE-2026-108072GHSA-23j4-jjc8-vpm7

Weak permissions in TSplus Remote Access let users run code as others

Priority LOW 25CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

TSplus Remote Access from 19.20.3.10 is affected. Incorrect default permissions (CWE-276) on shared autostart1.tscr files in the shared themes directory let users without sufficient privileges write to them. A local attacker with a valid session on the server can modify these files to run commands in another user's security context when that user logs in with the same theme or operating mode, enabling lateral movement or privilege escalation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TSplusTSplus Remote Access19.20.3.10—No fix listedCNA
  • TSplus Remote Access VendorTSplus Affected 19.20.3.10 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for TSplus Remote Access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-108072
  2. 2026-10-14 Alias added: GHSA-23j4-jjc8-vpm7
  3. 2026-10-14 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2023-14796 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-14795 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-14794 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-11941 TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the… CVSS 3.1CRITICAL 9.8
  • TI-2023-11940 TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the… CVSS 3.1CRITICAL 9.8
  • TI-2025-19291 hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to… CVSS 3.1MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences