CVE-2026-108070

{
  "etk_id": "ETK-2026-1564",
  "cve_id": "CVE-2026-108070",
  "display_id": "CVE-2026-108070",
  "ghsa_id": "GHSA-2xg6-fqm4-hc55",
  "euvd_id": "EUVD-2026-100980",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path-based access control bypass in TSplus Remote Access",
  "summary": "TSplus Remote Access web server contains an access-control bypass affecting internal resources. An unauthenticated remote attacker may access resources that should be restricted when they can reach the affected web service. The evidence does not identify affected version ranges.",
  "mitigation": "Restrict access to the TSplus Remote Access web server to trusted networks and users until remediation is available. Monitor vendor updates and apply a vendor-provided fix when released; no fixed version is recorded.",
  "vendor": "TSplus",
  "product": "TSplus Remote Access",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "19.20.3.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "TSplus Remote Access",
      "purl": null
    }
  ],
  "cwes": [
    552
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0045,
  "epss_percentile": 0.3796,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.918396183333334,
  "t0_at": "2026-10-14T10:54:58.334000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T10:54:58.334000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T10:54:58.334000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108070"
    }
  }
}