CVE-2026-108070: TSplus Remote Access Auth Bypass Vulnerability

CVE-2026-108070 Overview

CVE-2026-108070 is an improper access control vulnerability in the TSplus Remote Access web server. An unauthenticated remote attacker can reach internal resources by manipulating paths through the /socket.io/JWN/ endpoint. The flaw bypasses access restrictions intended to protect certain internal resources, exposing confidential data over the network. The weakness is tracked under CWE-552: Files or Directories Accessible to External Parties.

Critical Impact

Unauthenticated remote attackers can read internal resources exposed by the TSplus Remote Access web server, resulting in confidentiality loss without any user interaction.

Affected Products

• TSplus Remote Access web server

Discovery Timeline

• 2026-10-14 - CVE-2026-108070 published to the National Vulnerability Database (NVD)
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108070

Vulnerability Analysis

The TSplus Remote Access web server exposes a WebSocket-related endpoint at /socket.io/JWN/. Access controls applied to internal resources do not account for path manipulation reaching the server through this endpoint. An unauthenticated attacker can craft requests that traverse the intended authorization boundary and retrieve files or directories meant to remain internal.

Because the attack requires only network access and no credentials or user interaction, exposed TSplus Remote Access instances on the public internet face immediate risk. The impact is scoped to confidentiality; integrity and availability are not affected based on the published CVSS vector.

Root Cause

The root cause is improper access control [CWE-552] in request handling for the /socket.io/JWN/ endpoint. The server fails to normalize or validate manipulated paths before matching them against access policies. Requests that should be rejected are instead resolved against protected resources, allowing them to be returned to the caller.

Attack Vector

An attacker sends a crafted HTTP request to the /socket.io/JWN/ endpoint on a reachable TSplus Remote Access server. The request includes manipulated path components that evade the server's access checks. The server resolves the request to an internal resource and returns its contents without requiring authentication. Refer to the INCIBE Notice: Multiple TSPlus Vulnerabilities for coordinated advisory details.

No verified proof-of-concept code is published. See the vendor and INCIBE advisory for technical specifics.

Detection Methods for CVE-2026-108070

Indicators of Compromise

• HTTP requests to /socket.io/JWN/ containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or references to internal file paths.
• Unexpected 200 OK responses from /socket.io/JWN/ returning content types or payload sizes inconsistent with normal Socket.IO traffic.
• Access log entries from unauthenticated source addresses retrieving resources that normally require authentication.

Detection Strategies

• Deploy web application firewall (WAF) signatures that inspect requests to /socket.io/JWN/ for path manipulation patterns and block requests that attempt to escape the endpoint scope.
• Baseline normal Socket.IO request patterns and alert on anomalous methods, URIs, or response sizes targeting the TSplus Remote Access server.
• Correlate web server access logs with authentication logs to identify successful resource retrieval without a prior authenticated session.

Monitoring Recommendations

• Forward TSplus Remote Access web server logs to a central analytics platform and retain them for incident investigation.
• Monitor outbound network connections from the TSplus host for signs of follow-on activity after suspected disclosure events.
• Alert on repeated 4xx and 5xx responses from /socket.io/JWN/, which may indicate active probing.

How to Mitigate CVE-2026-108070

Immediate Actions Required

• Inventory all internet-exposed TSplus Remote Access deployments and restrict management interfaces to trusted networks or VPN access.
• Monitor the INCIBE advisory and TSplus vendor channels for a fixed release and apply updates when available.
• Review recent web server logs for requests to /socket.io/JWN/ and investigate any unauthenticated accesses that returned non-empty responses.

Patch Information

At the time of publication, no fixed version is listed in the NVD record. Refer to the TSplus vendor advisory and the INCIBE notice for upgrade guidance and patched release numbers.

Workarounds

• Place TSplus Remote Access behind a reverse proxy or WAF that blocks path traversal payloads and restricts requests to /socket.io/JWN/ to legitimate client patterns.
• Enforce IP allow-listing for the TSplus web server so that only trusted source networks can reach the vulnerable endpoint.
• Disable or isolate the Remote Access web interface from the public internet until a vendor patch is deployed and validated.

# Example nginx reverse proxy rule to block path traversal to the vulnerable endpoint
location ~* ^/socket\.io/JWN/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://tsplus_backend;
}