CVE-2026-108072: TSplus Remote Access Privilege Escalation

CVE-2026-108072 Overview

CVE-2026-108072 is an insecure file permissions vulnerability [CWE-276] in TSplus Remote Access. The flaw affects autostart1.tscr files located in the shared themes directory. These login scripts are writable by users who lack sufficient privileges to modify them. A local attacker with a valid session on the terminal or remote desktop server can replace the script contents. When another user logs in using the same theme or operating mode, the attacker's commands execute in that user's security context. Depending on the targeted account, exploitation enables lateral movement between users or privilege escalation to higher-privileged accounts on the same host.

Critical Impact

Local attackers with valid session access can execute arbitrary commands in another user's security context, enabling lateral movement or privilege escalation on shared terminal servers.

Affected Products

• TSplus Remote Access (shared themes directory containing autostart1.tscr login scripts)
• Multi-user terminal server and remote desktop deployments using TSplus Remote Access
• Environments where multiple users share themes or operating modes configured through TSplus

Discovery Timeline

• 2026-10-14 - CVE-2026-108072 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108072

Vulnerability Analysis

The vulnerability stems from incorrect filesystem permissions on autostart1.tscr scripts stored in the TSplus shared themes directory. These scripts run automatically during user logon as part of the theme or operating mode initialization. Because the files reside in a shared location accessible to all terminal server users, they execute in the security context of whichever user triggers login. The flaw maps to [CWE-276] Incorrect Default Permissions and requires only a valid local session to exploit. Impact scales with the privilege level of the user who logs in next while the modified script is in place.

Root Cause

The shared themes directory grants write access to low-privileged users on the terminal server. Login scripts that execute code in the caller's security context should be writable only by administrators. TSplus assigned permissions that allow any authenticated session user to modify autostart1.tscr, breaking the trust boundary between accounts that share a theme.

Attack Vector

An attacker first obtains a valid local or remote desktop session on the TSplus server. The attacker then overwrites autostart1.tscr with commands of their choice. When a victim user, including administrators, authenticates and loads the same theme or operating mode, the injected commands run under the victim's token. User interaction (the victim logging in) is required, which aligns with the attack complexity and user-interaction factors in the CVSS v4 vector. No verified public exploit code is available at this time.

// No verified exploit code is published for CVE-2026-108072.
// See the INCIBE advisory for additional technical context.

Detection Methods for CVE-2026-108072

Indicators of Compromise

• Unexpected modifications to autostart1.tscr files inside the TSplus shared themes directory, especially writes performed by non-administrator accounts.
• Child processes spawned at user logon that do not match the organization's standard logon script baseline.
• Commands launched under a privileged user's session shortly after a low-privileged user's session was active on the same host.

Detection Strategies

• Monitor file integrity on autostart1.tscr and other .tscr files within shared TSplus theme directories using endpoint telemetry.
• Alert on write operations to shared TSplus directories performed by any account outside an explicit administrator allowlist.
• Correlate logon events with process creation events to identify commands executed under one user that originated from scripts modified by another.

Monitoring Recommendations

• Enable Windows Security auditing (Event ID 4663) on the TSplus shared themes directory to capture write and append access.
• Baseline the contents and hashes of autostart1.tscr across themes and alert on any drift.
• Track Terminal Services session activity and correlate it with filesystem changes to identify multi-user abuse patterns.

How to Mitigate CVE-2026-108072

Immediate Actions Required

• Restrict write permissions on the TSplus shared themes directory and all autostart1.tscr files so that only administrators can modify them.
• Audit existing autostart1.tscr contents for unauthorized commands before allowing further user logons.
• Limit interactive and remote desktop access on affected servers to trusted users until permissions are corrected.

Patch Information

Refer to the INCIBE Security Notice on TSplus Vulnerabilities for vendor remediation guidance and fixed version information. Apply the TSplus Remote Access update that corrects the shared themes directory permissions as soon as it is available in your environment.

Workarounds

• Manually reset Access Control Lists on the shared themes directory to grant write access only to Administrators and SYSTEM, while retaining read and execute access for standard users.
• Separate theme directories per user or per privilege tier so administrators and standard users do not share login scripts.
• Disable unused themes and operating modes to reduce the number of autostart1.tscr files that must be protected and monitored.

# Example: restrict permissions on the TSplus shared themes directory (PowerShell)
$path = 'C:\Program Files (x86)\TSplus\Clients\www\themes'
icacls $path /inheritance:r
icacls $path /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F' 'Users:(OI)(CI)RX'
icacls $path /remove 'Everyone' 'Authenticated Users'