CVE-2026-108071: TSplus Remote Access MFA Bypass Vulnerability

CVE-2026-108071 Overview

CVE-2026-108071 is an authentication bypass vulnerability affecting the multi-factor authentication (MFA) mechanism in TSplus Remote Access. The flaw allows a remote attacker who already holds valid first-factor credentials to bypass the second-factor verification step. The authentication flow does not correctly apply the MFA validation result, so login succeeds even without a valid second-factor token. Successful exploitation grants access to protected applications and resources published through the TSplus Remote Access gateway. The weakness is tracked under [CWE-304] (Missing Critical Step in Authentication).

Critical Impact
An attacker with any valid username and password can defeat the MFA control and reach internal applications exposed through TSplus Remote Access, nullifying the second authentication factor.

Affected Products

TSplus Remote Access (MFA component)
Refer to the INCIBE advisory for the full list of impacted versions
Deployments where MFA is enabled as a secondary authentication control

Discovery Timeline

2026-10-14 - CVE CVE-2026-108071 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108071

Vulnerability Analysis

TSplus Remote Access publishes Windows applications and desktops through a web and RDP gateway. The product supports MFA as an additional authentication layer that should run after primary credential validation. In the affected versions, the authentication state machine does not correctly consume the MFA verification result before issuing a session. An attacker who authenticates with a stolen or guessed username and password can submit the login request in a way that causes the server to treat the user as fully authenticated. The gateway then issues a session token and grants access to published resources without ever enforcing a valid second-factor token. This defeats the intended defense against credential theft, phishing, and password reuse that MFA is deployed to mitigate.

Root Cause

The root cause is an authentication logic flaw classified under [CWE-304] (Missing Critical Step in Authentication). The server-side flow evaluates primary credentials and MFA independently, but the final authorization decision does not depend on the MFA result being successful. Because the critical validation step is skipped or ignored, the system falls back to a single-factor outcome whenever primary credentials are valid.

Attack Vector

The vulnerability is exploitable over the network against the TSplus Remote Access login endpoint. The attacker needs valid first-factor credentials for a target account, which can be obtained through phishing, credential stuffing, prior breaches, or password spraying. No user interaction and no local access are required. After submitting the crafted authentication sequence, the attacker reaches any application, drive mapping, or RDP session that the compromised account is permitted to use.

No verified proof-of-concept code is published for this CVE. See the INCIBE Notice on TSPlus Vulnerabilities for vendor-coordinated details.

Detection Methods for CVE-2026-108071

Indicators of Compromise

Successful TSplus Remote Access logins that lack a corresponding MFA challenge or MFA success event in the authentication log.
Session establishment events for accounts that have MFA enrolled but show no second-factor transaction.
Authentication activity from geolocations or source IP addresses that have never previously accessed the gateway for that user.
Short time delta between the primary credential submission and session issuance, inconsistent with normal MFA flows.

Detection Strategies

Correlate TSplus web portal and RDP gateway logs with MFA provider logs and alert on sessions created without a matching MFA success record.
Baseline per-user login behavior and flag deviations in source IP, user agent, and authentication timing.
Hunt for repeated authentication attempts against MFA-enabled accounts followed by immediate successful logins.

Monitoring Recommendations

Forward TSplus Remote Access authentication, session, and admin logs to a central SIEM or data lake for correlation and retention.
Enable alerting on anomalous RDP session starts, published-application launches, and file transfers that follow an atypical login pattern.
Monitor Active Directory and endpoint telemetry for post-authentication activity such as credential dumping or lateral movement from gateway-published sessions.

How to Mitigate CVE-2026-108071

Immediate Actions Required

Apply the fixed TSplus Remote Access version referenced in the INCIBE advisory as soon as it is available in your environment.
Restrict access to the TSplus Remote Access gateway to known source networks using firewall rules or a VPN front end until patching is complete.
Rotate credentials for privileged and high-value accounts that could be targeted through the exposed gateway.
Review authentication logs for the past 90 days to identify logins that did not generate a corresponding MFA event.

Patch Information

TSplus has coordinated disclosure through INCIBE. Administrators should consult the INCIBE Notice on TSPlus Vulnerabilities for the specific fixed version and update instructions. Apply the vendor-supplied update to the Remote Access server and any gateway components, then validate that MFA is enforced end to end after the upgrade.

Workarounds

Place the TSplus Remote Access gateway behind a VPN or zero-trust reverse proxy that enforces its own MFA before traffic reaches the TSplus login page.
Enforce IP allow-listing on the gateway so that only trusted administrative and user networks can reach the authentication endpoint.
Disable or restrict external access to accounts that do not require remote use, reducing the pool of first-factor credentials an attacker could leverage.
Monitor and alert on any authentication success where the MFA validation step is missing in the logs until the patch is deployed.