MajorCritical vulnerability

CVE-2026-108070 (CVSS 8.7)

NVD · officialPublished Oct 14, 2026Risk 37/100

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.

Technical details

CVSS

8.7

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source