CVE-2026-108070
8.7HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-552
Impact
Unauthenticated remote attackers can access protected internal files and resources over the network. They only need HTTP network access to the exposed web server.
Root cause
Improper access control in the web server allows path manipulation attacks via the /socket.io/JWN/ endpoint to bypass internal resource restrictions.
Affected systems
TSplus Remote Access (exact versions not listed — check the vendor advisory).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade TSplus Remote Access to the latest patched release per the vendor advisory; as an interim workaround, block external access to the /socket.io/JWN/ URL path on your reverse proxy or web application firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.