CVE-2025-26318 Overview
CVE-2025-26318 is an information disclosure vulnerability in TSplus Remote Access versions prior to 17.30 (2024-10-30). The flaw resides in the hb.exe component and allows unauthenticated remote attackers to enumerate the list of domain accounts currently connected to the application. The weakness is classified under [CWE-201] (Insertion of Sensitive Information Into Sent Data). Because exploitation requires no authentication or user interaction, attackers on the network can query the exposed endpoint directly. The disclosed account information supports reconnaissance activities that precede credential attacks and lateral movement.
Critical Impact
Unauthenticated remote attackers can enumerate active domain accounts on affected TSplus Remote Access servers, providing valuable reconnaissance data for targeted credential attacks.
Affected Products
- TSplus Remote Access versions prior to 17.30 (2024-10-30)
- The vulnerable component is hb.exe
- Deployments exposing TSplus Remote Access services to untrusted networks are at elevated risk
Discovery Timeline
- 2025-03-04 - CVE-2025-26318 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26318
Vulnerability Analysis
The vulnerability exists in hb.exe, a component of TSplus Remote Access that handles heartbeat or session state functionality. The service exposes information about currently connected domain accounts to unauthenticated network callers. Attackers can query the endpoint remotely and receive a list of domain user identities associated with active sessions. This exposure violates the principle of least privilege for information disclosure, as session enumeration should require authenticated administrative access. The vulnerability is tracked with an EPSS probability of 0.881%.
Root Cause
The root cause is missing access control on session state data returned by hb.exe. The component does not enforce authentication or authorization checks before returning connected account information. Sensitive session metadata is included in responses that any network-adjacent client can request. This aligns with [CWE-201], where the application inserts sensitive information into responses without validating the recipient's authorization.
Attack Vector
Exploitation requires only network access to the TSplus Remote Access service. An attacker crafts requests to the hb.exe endpoint and parses the response for domain account names. No credentials, session tokens, or user interaction are required. The disclosed identities can then be targeted with password spraying, phishing, or brute-force attacks. A public proof-of-concept has been published in the GitHub PoC Repository, which demonstrates the enumeration technique against unpatched servers.
Refer to the GitHub PoC Repository for technical details on the request format and response parsing used to enumerate connected domain accounts.
Detection Methods for CVE-2025-26318
Indicators of Compromise
- Unexpected inbound network connections to the hb.exe service from untrusted or external IP ranges
- Repeated or scripted requests to the TSplus Remote Access heartbeat endpoint from a single source
- Reconnaissance patterns followed by authentication attempts targeting domain accounts observed on the server
Detection Strategies
- Inspect network traffic to the TSplus Remote Access service and flag unauthenticated requests to hb.exe
- Correlate enumeration attempts with subsequent authentication failures against the same set of user accounts
- Baseline normal client access patterns and alert on high-volume or off-hours queries to the heartbeat component
Monitoring Recommendations
- Enable verbose logging on the TSplus Remote Access server and forward events to a centralized log platform
- Monitor Active Directory authentication logs for password spraying attempts that follow reconnaissance activity
- Track version inventory of TSplus Remote Access installations to confirm all instances are running 17.30 or later
How to Mitigate CVE-2025-26318
Immediate Actions Required
- Upgrade TSplus Remote Access to version 17.30 (2024-10-30) or later on all affected hosts
- Restrict network exposure of the TSplus Remote Access service to trusted management networks or VPN clients
- Review recent access logs for evidence of enumeration activity against hb.exe
Patch Information
TSplus addressed the vulnerability in Remote Access version 17.30 released on 2024-10-30. Administrators should update to this release or a later version to remove the unauthenticated information disclosure in hb.exe. Verify the installed version after patching and confirm the heartbeat endpoint no longer returns account data to unauthenticated callers.
Workarounds
- Place the TSplus Remote Access service behind a VPN or reverse proxy that enforces authentication before reaching hb.exe
- Apply firewall rules that limit inbound traffic to the TSplus service to known administrative source addresses
- Disable public exposure of the Remote Access web portal until patching can be completed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
