CVE-2026-108072

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.

• CWE-276

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tsplus-remote-access

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108065SQL Injection (CWE-89) in the SOAP GetUser method of the /pr…9.8
• CVE-2026-108066The WP 2FA WordPress plugin before 4.2.0 does not perform a…2.7
• CVE-2026-108069The Sunshine Photo Cart WordPress plugin before 3.7.4 does …5.3
• CVE-2026-10807A vulnerability was determined in mjperpinosa stumasy. The i…6.3
• CVE-2026-108070A vulnerability involving improper access control in the TSp…8.7
• CVE-2026-108071Incorrect authentication vulnerability in the TSplus Remote …8.7
• CVE-2026-108073The SureCart WordPress plugin before 4.9.5 does not restric…5.3
• CVE-2026-10808A vulnerability was identified in itsourcecode Fees Manageme…6.3
• CVE-2026-108082Symfony is a PHP framework for web and console applications …8.7
• CVE-2026-108086** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recu…
• CVE-2026-108087** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of s…
• CVE-2026-108088** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sens…